IS ENOUGH BEING DONE TO INFORM PATIENTS ABOUT PLANS TO USE DATA FROM THEIR GP RECORD?
GPDPR stands for General Practice Data for Planning and Research. This describes a new initiative from NHS Digital to collect data held in GP medical records, and replaces the General Practice Extraction Service (GPES), which has performed a similar function over the last 10 years.1 The difference with GPDPR is that the data extracted by NHS digital will be available to academic and commercial third parties for research and planning. NHS Digital will pseudonymise the data, which can be converted back to identifiable information in certain circumstances and where there is a valid legal reason.
Patients can opt out of NHS Digital collecting their data altogether by completing a ‘Type 1 Opt-out’ form2 and handing this in at their GP practice, or opt out of NHS Digital sharing their personally identifiable data by changing their settings on the NHS app or online. Initially, NHS Digital announced a 23 June 2021 deadline to hand in an opt out form, whereby anybody who opted out after the date extraction began would have been able to stop further data being collected or shared from that point. In an open letter to all GPs, Parliamentary Under Secretary of State Jo Churchill has since announced that in response to concerns from organisations including the Royal College of General Practitioners and the British Medical Association, NHS Digital will not set a specific start date for the collection of data until a means of deleting data that has previously been uploaded is established.3 This allows anyone who registers a Type 1 Opt out at any time to remove their previously collected data from the dataset, as well as prevent further data collection. Though the letter alludes to an eventual plan to retire Type 1 Opt outs, it refers to ensuring patients will always have an easy means of exercising their choice to opt in or out of data collection.
This is not unlike the care.data initiative that was scrapped around 2016, having been criticised for lack of patient awareness around the programme and how to opt out of it. The care.data plan in 2013 was for data from GPES to be pseudonymised and shared with third parties where appropriate for research purposes. The project launch included explanatory leaflets being sent to every household in the country. The chair of the then Health and Social Care Information Centre running the project said: ‘the huge benefits offered by the development of care. data are … clear but can only be delivered in the context of public understanding and trust.’ 4 GPDPR will serve a similar purpose to care.data. This time around, there seems to have been less of an effort to communicate the plans to patients. The majority of the communication has been published online by NHS Digital where it is searchable and accessible, rather than being sent to patients directly. NHS Digital posted an introductory video on YouTube on 12 May, which has had under 11 000 views at the time of publication (www.youtube.com/watch?v=YLi9gh7RyLA).
It is difficult to tell how many patients have engaged with the other explanatory content on the NHS Digital website, which some GP practices have linked to via their websites, or via a poster with a QR code in practices. Digital rights and healthcare data privacy campaign groups have been vocal in their concern about GPDPR. While NHS Digital has maintained that the programme is appropriate, has been carried out in consultation with a broad range of stakeholders, and upholds rigorous privacy and security standards, the letter published on 19 July acknowledges areas for improvement, and has paused the programme in part to allow more time to engage with patients, including non-digital means of communication.
The COVID-19 pandemic is a public health emergency that provides a legal basis to allow confidential patient information to be used and shared appropriately. GP data has been used effectively to protect the population — for example, by identifying clinically extremely vulnerable patients that needed to shield. We have lost many personal freedoms and rights in the public interest over the past 12 months, and getting back to where we were before will take time and depends on navigating safely out of the pandemic.
However, public understanding and trust remains as important as ever in how we use our patients’ data and comes back to a question of ethical principles. It’s difficult to reconcile the transition from current increased data sharing in the public interest to the same degree of data sharing beyond the pandemic by default, without a direct effort to inform each and every patient of this change and how they can opt out.
