July 2023 Update:
Roll-out of the GPDPR programme remains on pause due to the substantial concerns that were raised in 2021 - you can read more here about NHS Digital's update on the programme.
Much has changed since we originally published this news article, for example the progress made with Secure Data Environments. However, we wanted to keep these articles from us available for transparency, to show how UPD has responded to these developments over time.
May 2021:
NHS Digital recently announced a new system for collecting data from GP practices, which is called General Practice Data for Planning and Research (GPDPR).
It is not an entirely new process but a replacement of an existing system. In our view, while the new system is not perfect it is better than what happens now. GP surgeries already send patient data to NHS Digital through the current GP Extraction service (GPES), so some data from people’s health records is already held centrally. It is used by NHS commissioning bodies and third parties for research and planning purposes. And currently, researchers (including from commercial companies) can also go direct to GP surgeries to apply for access to data. We think it's better for there to be a single process to access GP data with more consistency and oversight, and less burden on individual GP surgeries.
It doesn’t solve all the issues, but the new system does improve on some of things that we know people care about. There is lots of research that investigates people’s attitudes towards how data from their health records is used, with some consistent findings. People tend to be more supportive of the use of health and care data for research and planning if certain conditions are met. Those conditions include de-personalising the data, independent oversight and transparency, especially if data may be accessed by third parties. Our Foundations of Fairness research, engagement work by One London and citizen’s juries led by the National Data Guardian all stress the importance of these conditions.
Although the new system is more transparent than the existing one, with better information on NHS Digital's site for patients and GPs, it is critical that the Data Protection Impact Assessment is published as soon as possible. Applications to access data that NHS Digital holds (including by commercial companies) are scrutinised by the Independent Group Advising on the Release of Data (IGARD), which publishes its minutes. The group includes health professionals, independent specialists and members of the public. But it’s also crucial that mechanisms are developed to involve patients and the public more widely, and in an ongoing way.
People can express an individual preference by opting out. However, there are two types of opt-out, and it's hard to understand how they will be applied. Media coverage so far has indicated that there is concern and confusion about the choices people have and the difference between a Type One Opt-Out *, and a National Data Opt-Out. As some data from GP records is already collected by NHS Digital, it is not the case that on the 1st of July the amount of data held by NHS Digital will go from nothing to everything. However, we urge NHS Digital to put more resource behind actively promoting the different choices available to people.
In the longer term, the answer to many concerns around privacy and commercial access to data will be to ensure all patient data is held in a Trusted Research Environment, which will reduce the need to send data to researchers. These are used in several health data settings, including one at NHS Digital, but it is not yet used for all data. This must become the default way patient data is held, managed and accessed in future.
---
* When this post was first published, we'd mistakenly linked to the wrong page for the Type One Opt-Out. We have now amended this following feedback.