Drug and insurance companies will from later this year be able to buy information on patients – including mental health conditions and diseases such as cancer, as well as smoking and drinking habits – once a single English database of medical data has been created.
Harvested from GP and hospital records, medical data covering the entire population will be uploaded to the repository controlled by a new arms-length NHS information centre, starting in March. Never before has the entire medical history of the nation been digitised and stored in one place.
Advocates say that sharing data will make medical advances easier and ultimately save lives because it will allow researchers to investigate drug side effects or the performance of hospital surgical units by tracking the impact on patients.
But privacy experts warn there will be no way for the public to work out who has their medical records or to what use their data will be put. The extracted information will contain NHS numbers, date of birth, postcode, ethnicity and gender.
Once live, organisations such as university research departments – but also insurers and drug companies – will be able to apply to the new Health and Social Care Information Centre (HSCIC) to gain access to the database, called care.data.
If an application is approved then firms will have to pay to extract this information, which will be scrubbed of some personal identifiers but not enough to make the information completely anonymous – a process known as “pseudonymisation”.
However, Mark Davies, the centre’s public assurance director, told the Guardian there was a “small risk” certain patients could be “re-identified” because insurers, pharmaceutical groups and other health sector companies had their own medical data that could be matched against the “pseudonymised” records. “You may be able to identify people if you had a lot of data. It depends on how people will use the data once they have it. But I think it is a small, theoretical risk,” he said.
Once the scheme is formally approved by the HSCIC and patient data can be downloaded from this summer, Davies said that in the eyes of the law one could not distinguish between “a government department, university researcher, pharmaceutical company or insurance company” in a request to access the database.
In an attempt to ease public concern, this month NHS England is sending a leaflet entitled Better Information Means Better Care to 26m households, to say parts of the care.data database will be shared with “researchers and organisations outside the NHS” – unless people choose to opt out via their family doctor.
However, a leading academic and government adviser on health privacy said pursuing a policy that opened up data to charities and companies without clearly spelling out privacy safeguards left serious unanswered questions about patient confidentiality.
Julia Hippisley-Cox, a professor of general practice at Nottingham University who sits on the NHS’s confidentiality advisory group – the high-level body that advises the health secretary on accessing confidential patient data without consent – said that while there may be “benefits” from the scheme “if extraction [sale] of identifiable data is to go ahead, then patients must be able find out who has their identifiable data and for what purpose”.
Hippisley-Cox added that “there should be a clear audit trail which the patient can access and there needs to be a simple method for recording data sharing preferences and for these to be respected”.
Davies, who is a GP, defended the database, saying there was “an absolute commitment to transparency” and rejecting calls for an “independent review and scrutiny of requests for access to data”. “I am tempted to say that we will have 50 million auditors [referring to England’s population] looking over our shoulder.”
He said it was necessary to open up medical data to commercial companies especially as private firms take over NHS services to “improve patient care”. Davies said: “We have private hospitals and companies like Virgin who are purchasing NHS patient care now. This is a trend that will continue. As long as they can show patient care is benefiting then they can apply.”
But Davies accepted there was now a “need to open a debate on this”.