July 2023 Update:
Roll-out of the GPDPR programme remains on pause due to the substantial concerns that were raised in 2021 - you can read more here about NHS Digital's update on the programme.
Much has changed since we originally published this news article, for example the progress made with Secure Data Environments. However, we wanted to keep these articles from us available for transparency, to show how UPD has responded to these developments over time.
June 2021:
We’re pleased that the Government has paused the roll out of the General Practice Data for Planning and Research (GPDPR) programme until September. The delay offers an opportunity: to take a different approach going forward and make sure the new system is rolled out in a more trustworthy way.
NHS Digital must use the time wisely and be properly resourced to do this well. A simple communications campaign will not to be enough to demonstrate that NHS Digital is a trustworthy steward of the nation’s GP data. Especially given the reaction to the programme so far. Turning this around will require investment in governance, transparency, communications and engagement.
At Understanding Patient Data, we have commissioned and collated public attitudes and engagement research over the past few years on precisely the sorts of issues that have come up about this programme. Based on what we know about people’s views, here’s what urgently needs to happen next.
Our 6 recommendations for NHS Digital
1. Make secure environments the default for data access
Within a secure environment, researchers come to the data: data is not sent out or downloaded. We’ve written more about what they are (and how they could be improved) here. Many are concerned that data will go beyond NHS control and be misused in breach of the rules, for example to reidentify individuals. Using a secure environment heavily mitigates this risk through technical measures. NHS Digital does have a secure environment in development and we’d urge them to prioritise this as a route for access to GP data. This will require investment to develop the platform, to make sure it’s accessible for a wide range of researchers (but always for specific purposes). Genomics England and the OpenSafely platform both use this model and are good examples of what this could look like.
2. Improve meaningful transparency about access to GP data
Meaningful transparency is about making information about the things people care about accessible and understandable. The NHS Digital website has a lot of information about how GP data is used: for example, all instances of access to data are published in a register that's updated monthly. But it’s a large, complex excel spreadsheet and it’s hard to scrutinise how data is actually being used in a way that enables ongoing public assurance. We know from our Foundations of Fairness research that 82% of people expect the NHS to publish information on third party access to data. But people also told us that it’s important this information is understandable, with an appropriate level of detail. NHS Digital needs to make it easier to see at a high level which organisations have had access to data and why, so they can show, not just tell, what they’re doing.
3. Invest in communications and media to respond to people’s concerns
NHS Digital needs to proactively respond to questions from media, GPs and the public, and correct the confusion that has dominated the narrative about the programme so far. This includes:
- Explaining the context: this is not an entirely new process and NHS Digital already holds some data from GP records (we’ve explained a bit about this here). NHS Digital needs to get clearer on what happens under the current system and what will change through the new programme.
- Clarifying the type of data included: NHS Digital does not get access to full patient records—it’s a series of codes and doesn’t include the notes a GP writes in a consultation. This might be easier for people to understand if it's demonstrated with examples or visuals.
- Describing safeguards: access to this data is highly regulated but explanations about the safeguards have so far been lost in the conversation. Instead, the argument that data is being pooled for easy access by third parties (particularly commercial organisations) has taken hold.
Addressing these issues will require visible, proactive leadership and quick reactions to rapidly correct any confusion. Mythbusting webpages alone will not be enough.
4. Clearly explain people’s choices
NHS Digital must put time and resource into explaining how the opt-out system works and crucially why it is not based on consent. There are valid reasons for this (which we’ve written about in the past), but so far they have been missing from discussions about this programme. People do have choices: there’s the Type 1 opt-out for GP data alone and the National data opt-out—they work in different ways and have different implications for the health system. It will be an uphill battle (but an important one) to explain these choices and what they mean simply and concisely. Given the lack of clarity so far, we suggest codesigning these communications with patients and public to make sure they’re accessible to a wide audience. This is too important to get wrong: the NHS and those it works with will struggle to plan, develop services and lead vital research if they don’t have data that is truly representative of the populations they serve.
5. Put new public benefit guidance into practice
The National Data Guardian is developing statutory guidance to help oranisations that hold data make sure they only grant access to it when there will be benefits for the public. The guidance has been developed through public engagement to make sure decisions about public benefit are informed by people’s views. This is especially critical when commercial organisations are involved, as we know from our research that improvements to health and care must always be prioritised over any financial gain. NHS Digital needs to commit to following the new guidance and then demonstrate how it’s done this, with clear examples of benefit over time.
6. Involve the public more in decisions about health data
This is data that has been collected in the context of a confidential relationship. For all the security and pseudonymisation measures in place, people still care deeply about how it’s used. From our research, we know people want to have a say: 74% of people believe the public should be involved in decisions about how NHS data is used. People want to know that their views are represented in what can be difficult value judgements about who should get access to this precious data and why. They may even be more ambitious than policymakers expect. This pause is an opportunity to build more ongoing and visible public representation into the process—the OneLondon public dialogues are a great example of this. This will take time, resource and investment that goes beyond the specifics of this particular programme, to the broader agenda of making the most of the data the NHS system holds. The opportunities include lifesaving research and the development of AI and digital technologies that could bring the NHS into the 21st century. But they will be missed if people don’t feel their interests are represented in these decisions.
There's a lot to do before September
If the Government really wants to take people with them on this journey, it needs to be far more ambitious in its approach to governance, transparency, communications and engagement. Otherwise, we’ll be back here in September—and again after that.