Evidence from NHS Digital's website suggests that patient data held by GPs in England will be available to private-sector companies to help them understand market opportunities in the UK's health service.
In response to government plans to start collecting patient data held by GPs into a central database, NHS Digital said it would "not approve requests for data where the purpose is for marketing... including promoting or selling products or services, market research or advertising."
It said requests for data would be assessed through the Data Access Request Service, part of NHS Digital. Independent oversight and scrutiny of applications would come from a Professional Advisory Group made up of representatives of the Royal College of GPs and doctors' union the British Medical Association, as well as the Independent Group Advising on the Release of Data (IGARD), also part of NHS Digital.
The Data Access Request Service, or DARS, already releases data under data-sharing agreements.
Although NHS Digital said that data would only be shared "with organisations who have a legal basis and meet strict criteria to use it for local, regional, and national planning, policy development, commissioning, public health, and research purposes," it gave no indication that the criteria used by DARS would change as a result of the move to share millions of GP-held records with little notice, dubbed "the biggest data grab" in the history of the NHS.
A recent data release register provided by DARS shows patient information is indeed used to scope market access by private drug companies through third-party information firms.
Among a long list of NHS and local authority data release records are companies including Wilmington Healthcare, a market research firm, Harvey Walsh, part of "world-class healthcare communications and market access group" OPEN Health and Health iQ which, it says, proves "the value of interventions in healthcare for successful market access."
Wilmington Healthcare is also the publisher of NHS management bible the Health Service Journal. The company's website says it helps clients "create a strategy to position their offering for maximum effect and execute this using a range of our customer engagement tools and go-to-market capabilities." According to the release register for March, its clients for accessing data included Lundbeck Ltd, a Danish drug company.
All this is perfectly above board. But given NHS Digital has not described how criteria for data access would change under the new General Practice Data for Planning and Research, it is hard to see how firms like these would be denied access to GP-held patient data.
It is also reasonable to assume that when a layperson hears that their data is used "to support health and care planning and research in England," they don't have private-sector access to health markets in mind.
The care.data era rules haven't changed
In 2016, The Register revealed NHS England spent nearly £8m on its controversial care.data programme before scrapping it. The publicly hated programme was beset by delays and criticised by doctors and privacy campaigners over the haphazard way it would share sensitive medical data of citizens with commercial companies without explicit consent.
Phil Booth, coordinator for campaign group medConfidential, said the rules over accessing data had not changed since they were agreed after the care.data programme was shut down, and would not change to introduce General Practice Data for Planning and Research.
"There have been all sorts of internal manoeuvrings, but the criteria in statute are broad enough to permit them to continue to service the same data customers, whatever bits of language they have published on their website," he told The Reg. "We are always grounded in what they are empowered to do in the law. And not just that, what have they done. Because the best indication of what's likely to happen is what just happened."
Under those rules, he said he expected market intelligence firms to continue to be served with data under the new programme for GP data. "This is market intelligence to those people, that's what information intermediaries do. Via the information intermediaries, the pharmaceutical sector is serviced."
Meanwhile, the wider public would have little knowledge of how their data might be used, and little time to opt out. "NHS Digital is a part of a system that has changed in response to problems before, and clearly shows some willingness to change [but] it is just going for people's GP data before it is ready to do so and before it can say this will actually be safe. They're doing so in a rush and they're not telling people, which means people are not getting the option to opt out in time," Booth said.
NHS Digital is yet to respond to The Register's request for comment. ®