Saturday, 1 March 2008

NHS Database: Are Connecting for Health Telling The Whole Truth?

"The main problem we are facing are two extremities – waiting patients and privacy fascists and we are trying to find a pathway for the middle of the two." - Richard Granger (former Chief Executive of CfH), April 2007

Like the National Identity Register, the NHS Spine (centralised NHS database of medical records) is another project with which New Labour seems determined to plough on, despite criticism from experts who say it is unnecessary, unworkable and unsafe.

One of the most prominent opponents of the Connecting for Health centralization project is Ross Anderson, Professor of Security Engineering at Cambridge University. He has been involved in patient privacy-related campaigning since 1995, and is currently an advisor to the main political campaign against the NHS Spine, the Big Opt Out campaign.

An article by Anderson, entitled 'Patient Confidentiality and Central Databases' (PDF), appeared in the February 2008 edition of the British Journal of General Practice (BJGP). The article detailed privacy, security and safety issues that Anderson has raised regarding the various aspects of the CfH project, and encouraged GPs to "empower patients to opt out", providing relevant information such as can be found at the Big Opt Out campaign website to all patients.

Two responses to the article, a response article and a letter both written by Connecting for Health directors, appear in the March 2008 edition of BJGP. I found these responses very interesting; not so much for what they did discuss (the Summary Care Record (SCR)) but for what they didn't (all of the other forms of centralized medical data storage that Anderson opposes).

Particularly striking was the following statement, in response to the (quoted) introductory paragraph from The Big Opt Out front page ("...This system is designed to be a huge national database of patient medical records and personal information [sometimes referred to as the 'NHS Spine'] with no opt-out mechanism for patients at all...") :

"We should be informing our patients that for the summary care record this statement is not true.." (bolding mine) - BJGP March 2008, pg205
Reading between the lines, either this statement is very carelessly worded, or what The Big Opt Out site says is true for other aspects of the Connecting for Health data centralization project.

As you might have guessed already (perhaps from actually reading the whole front page of the Big Opt Out website, rather than taking the first paragraph in isolation), this is indeed the case. Throughout the responses, the authors have either deliberately or inadvertently conflated the SCR with the NHS database taken as a whole. Whichever is the case, the effect is to mislead.

The Connecting for Health NHS database project consists of not one, but three main components: The Summary Care Record; the Detailed Care Record (DCR); and the Secondary Uses Service (SUS) (PDF)*. It could be said that the SCR is the 'acceptable face' of the project. The information to be stored is relatively minimal, and it is possible to opt out using 93C3 (Dr Rant). This is not the case for the other components, nor for the Personal Demographic Service database of address and phone data (TBOO)

To me, it is telling that the CfH responses in this month's BJGP neither discussed DCR and SUS at all, nor responded to most of the original article's arguments, instead resorting to attempting to discredit Prof. Anderson and The Big Opt Out (for instance, referring to, but not specifying "factual errors" (BJGP, March 08, pg148)), and even attacking the BJGP's editors for publishing Anderson's article in the first place!

Don't be taken in by this CfH bluster. The NHS Spine is a danger to your medical confidentiality. Opt out.

More information at NO2ID forums.

No comments: