Opt-out of the national NHS database

Dept of Health, Richmond House, 79 Whitehall, London 4 December 2006.

Dear................

Thank you for your letter to the Dept of Health about your participation in the NHS Care Record Service (NHS CRS). I have been asked to reply. You raise specific concerns about your personal health information being held electronically in a new NHS database as a summary care record, indicating that having your information held by the NHS in this way may cause you substantial unwarrented distress. You therefore asked the Sec of State to stop the process of adding your information to the new NHS database.

I have responded to your specific concerns in an annex to this letter. However, given that much of what has been published on this matter in inaccurate, I would first like to expalin why we are introducing the NHS CRS.

The introduction of modern technology is at the heart of the Government's modernisation plan for the NHS. Current record-keeping systems within the NHS require modernisation. For example, many patients are harmed every year due to the unavailablitity of readily accessible records of allergies and drug reactions, and poor handwriting and transcription errors. Other patients are forced to repeat their painful stories over and over again. Appointments are missed and tests are repeated beacuse records go missing. It is an unacceptable situation, especially when we have the means to improve it.

The new systems will improve healthcare for millions of people as well as preventing thousands of unnecessary deaths. These improvement will be delivered by ensuring that crucial patient information is available at the point of need. The changes we are making to the way the NHS holds and allows access to health information will lead to more accurate diagnosis and prescribing. The new systems will reduce adverse reactions to treatment, providing safer and better quality healthcare .Of particular importance is that the NHS will move from a position where patients have little or no knowledge of what is in their records and who accesses them, to one of greater knowledge and control.

I understand that people will always have concerns about the potential implications of new technology and I can assure you that these concerns were considered very carefully during the design stages of the new systems, on which there was wide consultation. To address these concerns, we have published the NHS Care Record Guarantee, which sets out how we will record, use and share care records and how we will keep them safe and confidential. I enclose a copy for your information.

The new NHS CRS systems have been designed specifically to support patient confidentiality and to restrict access to only those who need to see parts of your records in order to provide you with care. They will be more secure than existing systems, which were not designed specifically with confidentiality in mind.

With regard to your request that the Secretary of State stop the process of adding your information to the new NHS database, I am afraid that I am unable to comply.

The reasons that you give as the basis for claiming that substantial and unwarrented distress are not, as I hope I have made clear in the annex, based on accuate unerstanding of the summary care record, which we believe will benefit both you and the clinicians that care for you in that it supports them to provide better care. There needs to be therefore a genuine rason linked to substantial and unwarrented distress, for the NHS not to process your information.

Should you feel that there are further unique and personal reasons for claiming substantial and unwarrented distress that are not addressed by the safeguards and choices I have described in the annex, you should write, explaining those reasons, to:

Ms Linda Percival, Customer Service Director, Dept of Health.

I hope you will find this helpful. Yours sincerely. Jo Rees, Head of Correspondence.

------------------

Annex: (Quite long.) Detailed response to the reasons for claiming distress.

In your letter, you make 10 assertions. (Initailly listed but topic title given above each D0H reply below.)

My response to each of these assertions is set out below. I should first clarify that the database has been created to support the delivery of care to patients by the NHS in England. Different arrangements apply to other parts of the UK and you will need to make seperate enquiries to the relevant health organizations in respect of treatment outside England.

1). No 'sealed envelopes' yet exist to limit access.

Sealed envelopes will enable patients to identify specific entries within their records and to place them under additional controls so that they are not seen without consent. This will allow patients to determine, providing it does not put another person at sigificant risk, which parts of their records should be accessible to those providing care. It is correct that the sealed envelopes do not yet exist because they are still at the planning and development stage.

However, equally secure, though less flexible, measures are in place for the initial phase of the summary care record servie. The initial extract of information from the GP record will contain only basic information., i.e. details of patient medication and allergis. This will help to support treatment when unscheduled care is needed, such as in an accident and emergency department.

However, you will be able to have your persoal record flagged so that the summary care record cannot be accesses without your permission and, to ensure your wishes are known, you can do tghis even before the summary is created. If you are concerned, for example, that your medicines may indicate your condition and you do not want this information to be accessible, your record can be flagged and rendered invisible to NHS staff. The point is that you are in control. When you see your GP, you will be able to discuss whether more detailed information should be added and whether any of the information that has been added should be removed. You have the choice of a full summary, a partial summary, or a summary that can be seen only with your permission.

The same level of security provided by the seale envelpe procedure will therefore be available, through different means, in the early stages to limit access to your records. The sealed envelope function, which will give you even more choice, will be available in due course. We are currently working with the major suppliers of IT systems to the NHS to incorporate the seald envelope approach into their products as soon as this can be achieved. THis approach has been agreed following consultaton with the major clinical bodis, patient groups, and the Care Record Development Board (CRBD). It has their support, but we will be procedding cautiously and evaluating carefully as this represents a significant change to NHS record-keeping.

2) No online patient system yet exists to correct errors.

For safety and ethical reasons, there are very strict rules on altering clinical records, although health professionals are required to make a note within a record if a patient disagrees with what has been written. Complete records are essential to protect the interests of patients ansd satff, including ensuring that claims of negligence or malpractice can be investigated. I addition, information contained in records may be needed to explain whyu subsequent decisions were made. However, we recogise the need for a process for looking at the merits of each request for a record to be corrected and we are consulting on new guidance for the NHS to clarify the circumstances where information may be amended or removed rom clinical records. The guidance will be published before the first summary care records are introduced.

In addition to supporting more effective and efficient healthcare through effective IT systems, a new facility known as Healthspace is being developed to enable patients to view the content of their summary care record and to identify any inaccuracies. Healthspace will be amde available as soon as this is feasible.

3) Data uploaded may incluse genetic, psychological or sexual information.

The summary care record will be created from data uplaoded from the GP record. At first, this will be limited to details of medicaton and allergies. If patients are concerned that these may reveal more about them than they are comfortable with, they may register their dissent to information sharing. This will prevent anyone from seeing the summary without permission. Subsequently, when patients visit the surgery, their GP will discuss adding more details to the summary and patients can request that nothing be added if they have any concerns. They can also ask for information that has been added to be removed. In due course, the introduction of sealed envelopes will provide patients with even more control, allowing the information to remain in the summary in case of need, but locked away unless express consent is given to its disclosure.

4) It is intended to make my data available to social workers,researchers and commercial firms.

It is not true that personal patient data will be accessible by social workers, researchers and commercial firms. The current arrangements for dealing with any requests for information will continue to apply. The clinical information in your summary record will be controlled tightly and used only for providing care, supporting the provision of care and quality assaurance of the care provided. The care Record Guarantee, endorsed by the CRDB and Health Ministers. makes clear that permission will be obtained before any information is shared outside the team providing you with care.

Clinical data may also be released through the Secondary Uses Service but only in an anonymous form and only under strict controls. These controls have been endorsed by the patient Information Advisory Group (the independent dtaututory body that adviises on patient information issues), and, where appropriate, ethical approvals and information governance approvals are in plcae. The Secondary Uses Service is used by researchers and public health analysts to monitor trends and to plan for the treatment of illnesses and epidemics. This service is a more efficient and modern approach to supporting non-clinical uses of information that are both lawful and longstsnding across the NHS.

Whilst it is possible that the law or the Courts may require information to be disclosed, this is an extremely rare occurence and is no different from what hapens with patient records now. In very limited circumstances, the law also allows identifiable data to be used without patient consent for purposes such as important research. Again, this is not new, but, if you have registered within the new system that you dissent to information sharing, your records will not be used in this way. This is an improvement on older systems where your preference could not be recorded.

5) My consent will not be asked before beginning processing.

There has been public consultation on both the practical difficulties of creating summary care records and the enormous safety benefits that will be provided by these records. An incremental approach to implementation has been agreed that starts with information being extracted from GP records and placed on the NHS database. At first, this will contain only details of patient medication and allergies, but even this simple information will save many lives and improve health outcomes. A taskforce including representatives of patients, doctors, nurses and other health service professionals is advising on implementation. The first summary care records will start to be extracted from alimited number of GP records during 2007. Primary Care Trusts will notify registered patients in advance and it will be possible to discuss the matter with your GP before any information is extracted. Most importantly, in advance of a summary care record being created, you can ask for your records to be flagged so that they are not visible after they have been added to the database, so that even though you will not be asked for specific consent, you can register your dissent. The choice remains yours. Subsequently, when you see your GP for care purposes you will be able to agree what other information should be added to your national summary care record. Please be assured that there will be extensive communication within each community prior to the summary care record being introduced locally so that everyone has the opportunity to make this choice. The Information Commissioner is concerned to ensure people are well informed and we are keeping him informed about our plans as they develop to ensure that they are as effective as possible

6) Adequate criminal penalties against abuse do not yet exist.

The Secretary of State has strongly supported the Information Commissioners's call for greater penalties for misuse of people's personal information.

NHS staff have access to sensitive information now, with dew safeguards, and these is no suggestion that there is widespread abuse. In future, access will be controlled far more closely, fewer staff will be able to access full clinical records, and the system will record who has done what. Staff who misuseMHS IT systems or who breach patient confidentiality are breaking the law and may face legal action as well as dismissal. Offending doctors and nurses will be reported to their professional regulatory bodies and may face additional disciplinary action, including losing their licence to practice. However, if you are concerned that having a national summary care record places your information at risk you may ask for information to be withheld from it.

7) Police and other agencies can gain access to a potentially unlimited range of information about me. There is abundant evidence that computer databases-including police, vehicle licencing and banking computers - routinely penetrated by private investigators on behalf of client, including nedia organisations.

Police and other agencies do not and will not have direct access to any NHS data or to the new NHS database.They have to request information sepcifically. Public interest rules for disclosure to the police will not change when the new system is introduced and, as now, disclosures will only be considered in cases of serious crime or where there are significant risks to other people. Similarly, the NHS will remain liable to comply with statutory obligations to disclose, but these are always for sepcific purposes agreed by Parliament, such as to protect public health. Whilst criminal access to data, such as hacking, may be impossible to prevent entirely, the safeguards we are putting in place around the new systems will make them far more secure than existing NHS systems. If you remain concerned about the risks, you can choose to keep information out of the summary care record.

8) 250,000 smart cards have been issues granting access to the Spine. (NHSCRS)

Smartcards are secure tokens that, together with a password, confirn the identity of staff and determine access rights to information in line with the highest level of Government standards. They are more secure than the normal controls over public access to internet bank accounts. They are issued only when satisfactory evidence of identity and residence is provided in person by staff, for example, by production of a passport and utility bill. In respect of the clinical record, possession of a smartcard does not provide staff with uncontrolled access to records. Patient information is safeguarded by four levels of control. The smartcard is itself the first control. The second control is that access is limited to specific assigned roles (role-based access), which limit the information that can be seen by NHS workers depending on what they need to know to deal with you. Staff will be able to access only information that is relevant to their role within the healthcare team, so a receptionist will see information about your appointment, but would not be able to look at your detailed clinical records. The third control is that the system would not permit anyone to access your summary record unless they are registered within the system as working in a team that is providing you with care or are checking the quality of care provided - a new and very powerful safeguard that is referred to as a 'legitimate relationship'. The fourth control is provided by staff who oversee compliance with security processes. A record is kept within the system of who has done what. If required, it is possible to check if an irregularity is suspected.

I believe these safeguards are extremely strong. However, if you remain concerned your summary record can be flagged so that no member of staff can see it without your permission or you can talk to your GP about what information it should contain.

9) The Department threatens to with hold appropriate medical care to objectors.

Is is not true that we are threatening to with hold appropriate medical care to objectors. Entitlement to NHS care will be unaffected. Howveer, the NHS does need to operate on an efficient basis and deliver the maximum benefits to the maximum number of patients. Using scarce NHS resources to provide care that relies upon antiquated systems and processes and which is consequently less safe as well as more costly, is neither economically sustainable nor something that doctors and nurses should be asked to do. Whilst the current modernisation programme is unprecedented in scale, it build upon previous changes that demonstate clearly the advantages of modern and efficient equipment. The vast majority of pathology tests have been reported upon electronically for a number of years, dramatically improving the delivery of test results. Electronic prescriptions are eliminating the real dangers caused by handwriting that is hard to decipher. Many older imaging and scanning machines have already been replaced and with good reason. A recent study showed many hospitals reporting that 20 percent of x-ray films were missing when required. Some patients have to be x-rayed twice- an avoidable risk to patients that the new stystems eliminate. We are replacing older machines with new digital equipment as swiftly as we can. You are of course entitled to refuse treatment where you are concerned about the consequences, whether these relate to a type of surgery, a particular medicene or the record keeping that is required. However, the care will always be there for you when you need it. If you object to having your scans and x-rays held digitally in the new systems, it will be incrwsingly difficult to perform these tests as outdated machines are decommissioned and replaced. The controls we have introduced, which allow you to withold personal information from the summary record or to prevent access to the record without your permission, give you control over the information held within the system without having to forego the benefits of modrn healthcare.

10) Doctors say there is no necessity to design the Spine in this way.

While a few doctors have said that the Spine could have been designed in a different way, the majority - including some of the most senior and respected docxtors in the country - are supportive and believe that it will improve the delivery of healthcare to patients. On 16 November 2--6, Mr James Johnson, Chairman of the British Medical Association wrote to all doctors urging them to become fully aware of the new systems so that they can inform their patients about the changes, the benefits they bring and the choices that will be available. Joined up and accessible records are necessary to provide joined up and accessible care and the Government believes that it is unacceptable to prevent citizens from taking advantage of the available technology to improve diagnosis, care and treatment of illness.

.............................The End...................................................................