Nhs Patient Records

[joe.s-b]

How can I opt out of my NHS patient records being sold to all and sundry. I there is a way to object to this I must have missed it or don't know. So what can I do. I have no objection to my records being used by my surgeriy or the NHS for but that's all.

[TheWinner]

http://www.nhscarerecords.nhs.uk/optout

[Peter Pedant]

There was a round of this a few years ago
You should write to your GP saying that you dont want them centralised

Last time the clerks wre instructed to pass opters-out to the Min and they all got an email shot 'Do yo really want to do this'
and the patients responded by reporting the Chief Med Off to the GMC for breach of confidentiality

[pixie373]

I remember getting a letter a few years ago that i could return if i wanted to opt out. I thought it was for the ambulance service, etc. Who are they being sold to?

[jake-the-peg]

Unfortunately that's opting out of the whole summary care system - not just opting out of it being part of a sold database.

Personally I don't like it either but as I'd want an emergence A&E department to have access to my records as quickly as possible if I was say in an accident away from home I'm staying in

[jake-the-peg]

Frankly pixie it's a bit naughty.

The summary records are being sold to drugs research companies - to help them with research and business decisions.

They're not identifiable - they can't see it's you - it's summary data

But if it's data that's helpful for medical research it should be made available freely

If it's business data it shouldn't be sold

Mixing the two is why I say it's naughty

[joe.s-b]

Thank you all. I have no objection to my records being shown and used for medical reasons but certainly not for business purposes as I do not trust the users of such a database to be accurate about which organisation gets information.

[237SJ]

If they sold your details (name dob etc) they would be breaking the Data Protection Act.

[sunny-dave]

Wrong 237SJ - a common misapprehension about the DPA. It exists only to prevent 'unregistered use of data'.

If a company/organisation includes in their DPA registration that they intend to sell your info to the highest bidder, then they can do exactly that.


[ I used to do this stuff for a major PLC - as long as you register the proposed use and tell the data subjects, you can do pretty much anything with personal data ]

[237SJ]

OK sunny dave. I was just thinking about the DPA in my industry. There were a few changes to it a few years ago and we do an annual refresher about it because it`s such an easy law to break. Maybe it`s different in the NHS.

[sunny-dave]

The crucial bit of the DPA for the NHS is :

Under the terms of the Data Protection Act (1998), organisations such as the NHS must ensure that any personal information it gathers in the course of its work is :

"only used for the stated purpose of gathering the information (which in this case would be to ensure that you receive a good standard of healthcare)"

What exactly this covers is as vague as you like ... selling anonymised info to drug companies to monitor side-effects and develop new drugs could be construed as meeting the requirements ... or not.

The lawyers will have a field day if patient information (and possibly opt-outs) aren't done carefully. Glad I'm not holding that hot potato.

[Sqad]

Jake -the-peg.....I can't wait to hear that "statistic"....BUT....will that figure be the % of migrants in the migrant population OR % of migrants receiving benefits in the WHOLE population?

[237SJ]

If it is anonymised, it is not data though. Data is identifiable information about someone. For example, if we need to call for medical help, we have to get the person`s permission to give their name as the name is the data. If they refuse, we can still say (eg) male, 46 etc but not anything identifiable.

[Sqad]

Sorry wrong thread.......LOL

[sunny-dave]

I agree - under the current registration the NHS should not give identifiable data to anyone except for treatment of the individual concerned.

( although it could change its registration to allow that in other circumstances )


My first post was a bit of a kneejerk over-reaction - sorry - I must have woken up a bit grumpy today.

dave

[237SJ]

SD - if you are apologising to me you don`t need to. I didn`t think you were grumpy. The DPA is a minefield though - especially for global companies. There are all sorts of rules about info being shared between those with a need to know, it must stay within the EU, fines and prison sentences of up to 11 years for breaking it etc. That`s probably why we have to do a refresher for those parts of it that affect us - to cover our ar@es.

[joe.s-b]

OK. Now all as clear as it can be. Thanks