You have until June 23, 2021 to opt-out of your NHS data being shared with third-parties. Privacy campaigners have raised concerns that NHS Digital, which plans to make the medical histories of more than 55 million patients in England into a new database, including mental and sexual health data, criminal records and more sensitive information.
The deadline only applies to those who live in England and are registered to a GP clinic by NHS Digital, which runs the country’s healthcare IT systems.
So, what’s happening with all of this data? The information will purportedly be made available to academics and commercial third-parties. The records will be used for research and planning, campaigners say. NHS Digital shares a list of who it shares its data with, which is updated each month, although campaigners say it can be extremely difficult to find out who sees the data due to the NHS’ “opaque” commercial relationships.
According to the NHS, personal medical records will be anonymised to keep your identity secret. However, the code to unscramble the anonymised data will be held by the NHS and will be used to reveal the identity whenever there is “a valid legal reason”. Privacy campaigners claim overall plans are “legally problematic” and that patients have not been given enough time to opt out of the new policy.
Digital rights campaigners Foxglove have questioned the legality of the move in a letter sent to the Department of Health and Social Care.
Solicitor Rosa Curling wrote in the letter, “Very few members of the public will be aware that the new processing is imminent, directly affecting their personal medical data.”
To remove yourself from the database, you’ll need to fill out a form and submit it to your GP. If you don’t do this before the deadline, your medical records will become a permanent feature of the NHS Digital database. Opting out after the June 23 will still work, but will only apply to future data – any historic data will still be available to researchers, academic and commercial partners of the NHS.
Advocacy group MedConfidential, a privacy-focused group that has been pivotal to raising the alarm about the impending deadline, told the Financial Times, “They’re trying to sneak it out, they are giving you six weeks nominally and if you do not act based on web pages on the NHS digital site and some YouTube videos and a few tweets, your entire GP history could have been scraped, never to be deleted.”
This isn’t the first time the NHS has attempted to bring together GP records from patients across the country into a central database, Back in 2013, the Care.data programme was sold as a way to centralise digital health records, however, the project was abandoned three years later over privacy complaints.
The UK’s data regulator is believed to be producing an impact assessment, focusing on data protection, around the current plans from the NHS.