By Tom Harrison, Senior Policy Officer and Iain Millar, Graduate Trainee.
In June 2021, NHSX published a draft data strategy for health and social care. In the foreword, former Secretary of State Matt Hancock outlined his hope that the strategy will “unleash the unlimited potential of data in health and care while maintaining the highest standards of privacy, ethics and accountability”.
We welcome the ambitious approach. But the strategy is lacking detail in some areas that we know are crucial for earning and maintaining public trust. So we worked with the Ada Lovelace Institute and the Open Data Institute on a workshop to discuss key aspects of the strategy and how it needs to improve in order to deliver on its mission.
The session was structured around three areas which we believe need more focus: individual choice and control, public involvement and oversight, and data quality. Participants came from a range of backgrounds including academia, research and healthcare. Following the session, we put together a summary of feedback and recommendations which we shared with NHSX. This included an offer to help with embedding public involvement in decisions about NHS data on a long-term basis.
All three organisations also wrote to Sajid Javid, the new Secretary of State for Health and Social Care, to highlight these recommendations and request a meeting to discuss them in more detail.
Building on what we heard from our community at the workshop, we at Understanding Patient Data have put together four recommendations for the Government and NHSX. These will all require sustained investment and resourcing – but they are crucial if the strategy is to uphold “the highest standards of privacy, ethics and accountability”.
1. Deepen the consultation process
This summer is an opportunity to reset the approach to consultation on the strategy. NHSX is running a public survey but this fails to offer a meaningful way for people to give feedback. The short timeframe (even with an extension into August) has compounded concerns that significant changes in how health data is used are being rushed through without adequate consultation and oversight. The public and media reaction to the recent GPDPR programme shows just how deep those concerns are – and the impact of getting this wrong.
We recommend the Government uses this time to run a more in-depth consultation, at a level usually expected from a Green Paper. This would help demonstrate the Government's commitment to listen to public and professional views, and set a positive tone for future engagement about the use of health data.
2. Provide clarity on individual rights
NHS patients in England have two ways to express a choice about how data about them is used. There is the Type 1 Opt-Out for primary care data which is registered via individual GP surgeries, and the National Data Opt-Out which is administered through NHS Digital. The strategy doesn’t reference either of them.
NHS Digital data from July 2021 shows that the National Data Opt-Out has been registered by 3.1M people, representing approximately 5% of NHS patients in England. This is a rise of 1.27M since the announcement of the GPDPR programme in May 2021.
Given the recent rise in the number of opt-outs, it is more important than ever to clarify their role in the future. As the current system is not based on consent, making sure people have a way to opt-out is integral to the Government and the NHS’s social license to collect and use health data. If the Government is committed to this system, the strategy should outline how both opt-outs can work together and set out measures for clear, transparent communication about them.
3. Meaningfully involve people, on an ongoing basis
When involved authentically, the public can be an important enabler and champion for the use of patient data. Public involvement can help decision makers spot (and adapt to) potential risks and areas of concern. Involving people early can therefore help avoid controversy and prevent actions that damage public trust.
While the strategy references a few specific examples of public involvement, NHSX should back longer-term, sustainable, locally-driven data governance activities across England. This could build on the workshop we ran with NHSX back in May, and the great engagement work that has been trialled at a national level, such as the Data Sharing in a Pandemic citizen's juries. One-off national exercises are good for testing public opinion, but trust building requires long-term proactive engagement. There are many flexible and adaptive ways to do this, we’ve done some thinking about one approach which we call ‘Learning Data Governance'.
4. Demonstrate value from data partnerships
The strategy outlines the importance of securing ‘fair returns’ when NHS organisations give third parties access to patient data. This is welcome, as we know people are particularly concerned about the risks of commercial exploitation and widening inequalities.
However, the NHS is a complex system, made up of hundreds of organisations. Many agreements with third parties about data are made at an NHS Trust or community service level. At present, there is limited publicly available information about these types of partnerships and the value they bring back to the health service and patients.
That’s why NHSX should build on the model of the revised Data Uses Register by NHS Digital. The register provides information about data sharing agreements with third parties, including the benefits expected from each deal. This information should also be available for agreements made at the Trust or ICS level, ideally within one register. The register should show the details of each agreement, and also include data visualisations so it's possible to quickly see a high-level summary of which organisations have access to patient data – and why.
Let us know what you think
We’ll be watching to see how the strategy evolves over the next few months, and how NHSX responds to feedback from the community. In the meantime, we’d love to know what you think of these recommendations. Please drop us a line at firstname.lastname@example.org.