Five months after the most recent delay to the care.data launch, I’ve come to the conclusion that we must seek long-term excellence in its performance, not content ourselves with a second-rate dress rehearsal.
“Sharing our medical records, is like playing Chopin. Done well, it has the potential to demonstrate brilliance. It separates the good, the bad and the ugly, from the world-class players. But will we get it right, or will we look back at repeat dire performances and can say, we knew all the right notes, but got them all in the wrong order?”
The vast majority were from organisations which are data users, some names familiar from the care.data press coverage in spring, [Beacon Consulting, Harvey Walsh] plus many university and charity driven researchers.
Sir Kingsley Manning, Sir Nick Partridge and Andy Williams [The CEO since April 2014] all representing HSCIC, spoke about the outcomes of the PWC audit, which sampled 10% of the releases of identifiable or pseudonymous data sharing agreements for closer review, and what is termed ‘Back Office’ access (by the police, Home Office, court orders) in the eight years as the NHS IC prior to the HSCIC rebrand and changes on April 1st, 2013.
“The standard PwC methodology was adopted for sample testing data releases with the prevailing governance arrangements. Samples were selected for each of the functional areas under review. Of the total number of data releases identified (3,059); approximately a 10% sample was tested in total.” (Report, Data Release Review June 2014)
I believe it is of value to understand how we got here as well as the direction in which the HSCIC is moving. This is what the meeting sought to do, to first look back and then look forward. They are Data Controller and Processor of our health records and personal identifiable data. As care.data pathfinder pilots approach at a pace, set for ‘autumn’, the changes in the current processes and procedures for data handling will not only effect records which are already held, from our hospital care and other health settings‘, but they will have a direct effect on how our medical records extracted from GP practices will be treated, for care [dot] data in the future.
Data Management thus far has failed to meet the standards of world class delivery; in collection, governance and release
It made me think, that sharing our medical records, is like playing Chopin. Done well, it has potential for brilliance. It separates the good, the bad and the ugly, from the world-class players. Even more so, when played as part of suite, where standards are understood and interoperable . Data sharing demands technical precision, experience and discipline. Equally, gone wrong, we can look back at past performances and say, we had world class potential and knew all the right notes, but got them all in the wrong order. Where did we fail? Will we learn, or let it repeat?
The 2.5 hour event, focused more on the attendees’ main interest, how they will be affected by any changes in the release process. Some had last received data before the care.data debacle in February put a temporary halt on releases.
As a result of planned changes, will some current data customers find, that they have already received data for the last time, I wonder?
After the initial review of the critical findings in the Partridge report, the discussion centred on listening to suggestions what may be done in England to prevent future fails. But in fact, I think we should be going further. We should be looking at what we are doing in England to be the world-class player that the Prime Minister said he wants.[5]
We are focused on making the best of a bad job, when we could be looking at how to be brilliant.
To me, the meeting missed a fundamental point. Before they decide the finer points of release, they need to ensure there will be data to collect. There was not one mention of the public’s surprise that our data was collected and had been sold or shared with each of them until last spring. So now that the public in part knows about it, the recipients should also consider we are watching them closely.
Data users are being judged as one, by their group performance
What the data recipients may or may not be conscious of, is that they too each are helping to shape the orchestra and will determine the overall sound that is heard outside.
They may not realise that as data recipients, we citizens, the data providers, will see and hear their actions and respond to them all collectively, in terms of what impact it may have on our opt in/out decision.
I heard on Monday one or two shriller voices from global data intermediaries claiming that others had been receiving data whilst their own requests had been overlooked. As of last Friday, HSCIC said 627 requests were on standby, waiting for review and to know whether or not they would receive data. Currently HSCIC is getting 70 new requests a month. Bearing in mind the attendees were mostly data users, they can be forgiven that they were mostly concerned about data release and use, but they did in part also raise the importance of correct communication, governance and consent of extraction. They realise without future public trust, there is no future data store.
One consultancy however, seemed to want to blame all the other players for their own past mistakes, though there was no talk of any blame in any discussion otherwise. They asked, what about the approvals process for SUS (Secondary Uses Service data), how are those being audited and approved, is it like HES? How about HSCIC getting their act together on opt out, putting power back in the hands of patients, they asked. What about the National Cancer Registries, ONS (Office of National Statistics), all the data which is not HES, will there be one entrance point to access all these data stores for all requests? And as for insurance concerns by patients, the same said, people were foolish to be concerned. Why, “if they don’t get our health data then all the premiums will go up.”
My my, it did feel a little like a Diva having a tantrum at the rest of the performers for messing up her part. And she would darn well pull the rest of them into the pit with her if she was going to get cancelled. In true diva style, I’m sure that company didn’t even realise it.
But all those data recipients are in the same show now – if one of them screws up badly, the critics will slam them all. And with it, their providers of data, we patients, will not share our data. Consent and confidentiality are golden tickets and will not be given up lightly. If all the data-using players perform well, abide by the expected standards, and treat both critics, audience and each other with proper etiquette, then they will get their pay, and get to stay in the show. But it won’t be a one time deal. They will need to learn continuously, do whatever the show conductor asks, and listen and learn from the critics as they perform in future, not slacking off or getting complacent.
Whilst the meeting discussed past failings in the NHS IC, I hope the organisations will consider what has truly shocked the public is some of the uses to which data has been put. How the recipients used it. They need to examine their own practices as much as HSCICs.
The majority of the attendees were playing from the same score, asking future questions which I will address in detail in part two.
The vast majority asked, how will the data lab work? And other Research users asked many similar and related questions. [This from medConfidential [6] whilst on the similar environment for accredited safe havens, goes some way to explaining the principle of a health research remote data lab (HRRDL).]
Governance questions were raised. Penalties were an oft recurring theme and local patient representative group and charity representatives, asked how the new DAAG lay person appointments process would work and be transparent.
Other questions on past data use, were concerned with the volume of Back Office data uses. The volume of police tracing for example. How person tracing by the border agency, particularly with reference to HIV and migrant health, which may reveal data to border agencies which would not normally be shared by the patients’ doctors. “If people are going to have confidence in HSCIC, this was a matter of policy which needed looking at in detail. ” The HSCIC panel noted that they also understood there were serious concerns on the quantity of intra-government departments sharing, the HMRC, Home and Cabinet Offices getting mentions. “There was debate to be had”, he said.
They’re collectively recovering from unexpected and catastrophic criticism at the start of the year. It is still having a critical effect on many organisations because they don’t have access to the data exactly as they used to, with a backlog built up after a temporary stop on the flow which was restarted after a couple of months. HSCIC has reviewed themselves, in part, and any smart attendees on Monday will know how each of their organisations have fared. The audit has found some of their weaknesses and sought to address them. There is a huge number of changes, definitions and open considerations under discussion and not yet ready to introduce. They realise there is a great amount of work still to be done, to bring the theory into practice, test it out, edit and get to a point where they are truly ready for a new public performance.
But none of the truly dodgy sounding instruments have been kicked out yet. I would suggest there are simply organisations which are not themselves of the same standards of ethics and physical best practices which deserve to manage our data. They will bring down the whole, and need rejected – the commercial re-use licenses of commercial intermediaries. And the playing habits of the data intermediaries need some careful attention, drawing the line between their clinical support work and their purely commercial purposes. The pace may have slowed down, but data is still flowing out, and there was no recognition that this may be without data protection permission or best practice, if individuals aren’t aware of their data being used in this way. The panel conducted a well organised and orderly discussion, but there were by far more open questions, than answers ready to be given.
What we do now, sets the future stage of all data sharing, in the UK and beyond – to be brilliant, will take time to get right
How HSCIC puts into action and implements the safeguards, processes and their verbal plans to manage data in the short and medium term, will determine much for the future of data governance in England, and the wider world. Not only in terms of the storage and release of data – its technical capability and process governance, but in the approach to data extraction, fair processing, consent, communication and ongoing management.
This is all too important to rush, and I hope that the feedback and suggestions captured on the day will be incorporated into the production. To do so well, will need time and there is no point in some half-ready dress rehearsal when so much is yet to be done.
The next Big Thing – care.data
When it came to care.data, Andy Williams said it had been a serious failing to not recognise that patients view their GP records quite, totally differently, from the records held at a hospital. Sharing their HES data.
“And it is their data, at the end of the day,” he recognised.
So to conclude looking back, I believe where data sharing has reached, is leaps and bounds ahead of where it was six months ago. The Partridge Review and its recommendations recognises there are problems and makes 9 recommendations. There is lots more the workshop suggested for consideration. If HSCIC wants to achieve brilliance, it needs to practise before going out on a public stage again. The excellence of Chopin’s music does not happen by chance, or through passion alone. To achieve brilliance we cannot follow some romantic notion of ‘it will all be alright on the night’. Hard edged, technical experience knows world-class delivery demands more.
So rolling out care.data as a pathfinder model in autumn before so much good preparation can possibly be done, is in my opinion, utterly pointless. In fact, it would be damaging. It will be like pushing a grade 5 school boy who’s not ready into the limelight, and just wishing him luck, while you wait whistling in the wings. But what will those in charge say?
[9] Classic comedy Morecambe & Wise, with Andre Previn – all the right notes, but not necessarily in the right order https://www.youtube.com/watch?v=-zHBN45fbo8
[10] Blog post part two: care.data is like playing Chopin – or will it be all the right notes, but in the wrong order? [Part two – future]
“That November farewell, given in aid of a Polish charity, came at the end of a difficult six-month British sojourn, which had included concerts in Manchester (one of the largest audiences he ever faced), Glasgow and Edinburgh, where the non-religious Chopin had unwillingly endured Bible readings by a pious patroness anxious to convert him to the Church of Scotland. Finally back in London, the composer-pianist spent three weeks preparing for what turned out to be his final recital by sitting wrapped in his coat in front of the fire at St James’s Place, attended by London’s leading homeopath and the Royal Physician, a specialist in tuberculosis. A week after the concert, he was on his way home to Parisian exile and death the following year.”
Born Zelazowa Wola, Poland of a French emigrant father and Polish mother, he left Poland aged 20, never to return. Well known and by some controversially for his long romantic liaison with novelist George Sand (Aurore Dudevant) after they separated his health failed and in 1848 he paid a long visit to Britain where he gave his last public performance at the Guildhall. He died in Paris.
How our data sharing performance will be judged, matters not just today, or in this electoral term but for posterity. The current work-in-progress is not a dress rehearsal for a care.data quick talent show, but the preparations for lifetime performance and at world standard.
How have we arrived where we are now, at a Grand Pause in the care.data performance? I looked at the past, reviewed through the Partridge Review meeting in [part one here] the first half of this post from attending the HSCIC ‘Driving Positive Change’ meeting on July 21st. (official minutes are online via HSCIC >> here.)
Looking forward, how do we want our data sharing to be? I believe we must not lose sight of classical values in the rush to be centre stage in the Brave New World of medical technology. [updated link August 3rd]* Our medical datasharing must be above and beyond the best model standards to be acceptable technically, legally and ethically, worldwide. Exercised with discipline, training and precision, care.data should be of the musical equivalent of Chopin.
Not only does HSCIC have a pivotal role to play in the symphony that the Government wishes research to play in the ‘health & wealth’ future of our economy, but they are currently alone on the world stage. Nowhere in the world has a comparable health data set over such length of time, as we do, and none has ever brought in all it’s primary care records into a central repository to merge and link, as is planned with care.data. Sir Kingsley Manning said in the current July/August Pharma Times article, data sharing now has to manage its reputation, just like Big Pharma.
Pharma Times – July/Aug 2014 http://www.pharmatimes.com/DigitalOnlineArea/digitaleditionlogin.aspx
Countries around the world, will be watching HSCIC, the companies and organisations involved in the management and in the use of our data. They will be assessing the involvement and reaction of England’s population, to HSCIC’s performance. This performance will help shape what is acceptable, works well and failings will be learned from, by other countries, who will want to do the same in future.
Can we rise to the Challenge to be a world leader in Data Sharing?
If the UK Government wants England to be the world leader in research, we need, not only to be exemplary in how we govern the holding, management and release of data, but also exemplary in our ethics model and expectations of each other in the data sharing process.
Regular readers here or on twitter, may notice the new-look.
I’m moving away from The Amateur Book Blogger banner, and will be posting simply as me, as I go on. The start of the summer holidays seemed as good a day as any, to saunter out into the sunshine on my own. [I may even see if it’s worth updating my resultant twitter handle @TheABB]. The reason? This week, the View From Here Magazine announced it will be closing on November 1st, 2014. After seven years on the writing team, it is not only the end of an era, but perhaps the start of a something new.
I started on the comms side, announcing writing events and industry news, and later moved into interviews. It’s been an amazing experience. Editor Mike French was a great remote-mentor. We’ve met only once, at the launch of his latest novel, Convergence, in The Dandelion Trilogy. Mike both enabled and encouraged me to interview some great writers, editors, scouts and publishers, every quarter. I learned something new each time, from every contribution, and had great fun. All of which I enjoyed, but some stand out in the memory more than others, and every one was unique.
Thank you to all whom I have interviewed since 2006, but also to readers and fellow unpublished writers who supported me, the team, and made the community at The View From Here what it is. With eclectic tastes, I learned much on writing, but also enjoyed the art of the creative collective.
The most recent interview I did for them, was here, with Isabel Allende. In her wide ranging career, it was hard to know what to ask and how to narrow it down, but one thing stays with me, in all she said, on the role of a writer:
“Writers have no obligation to comply with the official story or the official version, their only obligation is with their own consciousness. Honesty above all.”
The other part of my writing recently has been more akin to her engagement in politics and civil society. I’ve been on twitter really only for the last nine months, throughout the difficult pregnancy of care.data, pronounced care [dot] data. If you missed it, that’s the government proposed scheme to suck up our GP medical records, merge them with data already held at the central Health and Information Centre from our hospital care, and then use the new, richer record for commissioning purposes and potentially more, as yet undefined. Since our hospital and other health sourced-data is already sold to private companies and will continue to be so in future, but without having asked for informed consent, I’ve been a very skeptical critic and lay voice for positive changes for these wide secondary uses. [In case you’ve landed here for the first time, I’ve a background in tech database implementations, communications and change, and I took it upon myself to fully understand and follow the subject, a year ago when I came across the topic online, by accident.]
It looks now, as though some improvements on past failings will happen, but much remains undefined in detail, and as we all know, that’s where the devil likes to sup. I look forward to seeing some of the recently discussed changes and definitions in the Care Act, for example, becoming concrete.
So, that’s the reason for the insignificant changes on my part, and should I explain the image? I’ve chosen my favourite coffee mug for my header photo, with my favourite scarf. I use both often. The latter, reminds me a little of Bridget Riley’s op art. As a retro fan that appeals to me. The former, depicts the cover of Susan Stebbing’s most popular work Thinking to some purpose (1939) which was described on the cover of the first Pelican Books edition as being:
“A manual of first-aid to clear thinking, showing how to detect illogicalities in other people’s mental processes and how to avoid them in our own”
The work arose out of a synopsis she wrote for a series of radio broadcasts intended for the BBC. Published on the eve of the Second World War, Stebbing wrote:
“There is an urgent need to-day for the citizens of a democracy to think well. It is not enough to have freedom of the Press and parliamentary institutions. Our difficulties are due partly to our own stupidity, partly to the exploitation of that stupidity, and partly to our own prejudices and personal desires.”
Her words seem very timely.
To borrow from Wikipedia here: “This metaphor seems to me to be appropriate, because potted thinking is easily accepted, is concentrated in form, and has lost the vitamins essential to mental nourishment. You will notice that I have continued the metaphor by using the word ‘vitamins.’ Do not accept the metaphor too hastily: it must be expanded.”
“Potted meat is sometimes a convenient form of food; it may be tasty, it contains some nourishment. But its nutritive value is not equivalent to that of the fresh meat from which it was potted. Also, it must have originally been made from fresh meat, and must not be allowed to grow stale. Similarly a potted belief is convenient; it can be stated briefly, sometimes also in a snappy manner likely to attract attention. A potted belief should be the outcome of a belief that is not potted. It should not be held on to when circumstances have changed and new factors have come to light. We should not allow our habits of thought to close our minds, nor rely upon catch-words to save ourselves from the labour of thinking. Vitamins are essential for the natural growth of our bodies; the critical questioning at times of our potted beliefs is necessary for the development of our capacity to think to some purpose.”
So here’s to that, my ‘critical questioning’ may have shifted from one arena into another, but I hope I continue ‘thinking to some purpose’.
I looked in two previous posts at the background theory [1] to commercial uses of our data, then, the background to my concerns of commercial use with data intermediaries. [2] This is now part three, my glimpse into commercial use in real-world practice. It’s become rather a saga.
Here’s the short version: “In general commercial uses of data, I am increasingly learning that if you don’t pay for the product, you are the product. We need to shout a bit louder, that we are not a product for sale. It’s not only that there is an increased risk in a move of our health records from binder to byte and broadening access to them. We take issue with the change of approved purposes from care, to commercial use.”
At the Health Select Committee on July 1st, [3] I believe Sir Manning misses the key issue the public has with care.data and health record sharing, when he gave a response to Q562 to David Tredinnick MP:
‘We made big mistakes over the last 10 years’
“I am saddened by some of the comments that have been made this afternoon about the lack of trust and also by the impugning of our motivation. […]
We made big mistakes over the last 10 years, and we have a once-in-a-generation chance to get it right. I am absolutely clear that we have to engage the public in an open debate about the balance of risks and benefits. There will always be risks with data. There were risks with the Lloyd George envelope; notes were lost, they flew and went all over the place. There will always be risks, but those risks and the benefits are both enhanced by the technology.”
Whilst I applaud Sir Manning’s apology, and his call for open debate, I think he misses here the fundamental point of disagreement the public has with the HSCIC current practice. Selling our health data.
It’s not only that there is an increased risk in a move from binder to byte and broadening their access.We take issue with the change of approved purposes from care, to commercial use.
And these commercial (ab)uses in current form must stop if we are to trust the governance system in future.
Health Records for Commercial sale
HSCIC currently sells our health records for commercial purposes, to intermediaries with commercial re-use licenses, and had no consent nor our permission for this in the past, it continues to do so in the present and appears to have no concern or intention to stop doing so, for the future.
Mr. Kelsey added at the HS Committee,
“We have a very big job to do, and I hope that you will hold us to account in delivering it.”
To which I can only reply, it is you who say it. But who is accountable? The Open Debate which Sir Manning calls for has not been taken up by NHS England. We are told this is a programme of national importance, one which Mr. Kelsey has repeatedly said, including to the Health Select Committee previously, on which the entire future of the NHS depends. Why then, no national discussion, no news since the pause and a focus on updated communications of the current plan. The current plan with flaws in consent collection, scope determination, confusion of purposes.
There are so many ways this could be improved and gotten right, but not by November and without public debate.
How can you insist a programme so vital for the entire future of the NHS yet encourage no public discussion? This seems to be a theme in NHS England recent programmes. [4] The decision to outsource the GP support services was taken in private sessions, not available to the public like the rest of the Board Meetings [5]. Other programmes, pilot and actual plans for implementation go on without public discussion.
There’s been no apology for the data sharing policy developed since 2010 which has encouraged commercial trading and enabled this erosion of security, confidentiality and trust in the data management system of our nation’s health records. No one at the Department of Health has said, we got this policy wrong. No one at NHS England, the same people if under a different label. Poor Sir Manning at the Information Centre who carried out their policy, has been left to say there were ‘big mistakes’ made. But not by him since July 2013.
Trust and care.data off course
That our trust now lies in tatters, is not the fault of the Health Select Committee member to whom Sir Manning says, he is saddened and disappointed. It’s not Joe Public’s fault who had no idea this was going on, until six months ago. Where did these policies and plans since 2010 come from? Where did the use of our data go so astray and why is flagship care.data now so terribly off course? Mr. Cameron outlined it in 2011. What happened in the three years?
Health records for sale
As I wrote in a previous post,
“Some of that data goes back into our health market as business intelligence, both for NHS and private use, for benchmarking, comparisons and making commercial decisions. In our commissioning based marketplace, this re-use of data is now becoming normalised.”
But should it be normal that our medical records are for sale?
When celebrity Michael Schumacher’s notes are for sale, [6] being offered concretely to the media, we all see that is wrong. Just imagine 70 million copies of Schumi’s record, each with our own name on it, being offered to anyone outside of those who need it for our care. Offered to these commercial for-profit data intermediaries. It’s not a theory – this is what is happening to our records, today. Don’t accept the ‘anonymised’ statements, they’re simply not true. Identifiable data and pseudonymous data has been sold. The register confirms it, and that was only a 10% sample.
“To earn the public’s trust in future, we must be able to show that our controls are meticulous, fool-proof and solid as a rock.”
I think banning data sharing for commercial use and re-use would be a good start.
What is it to be used for and why?
When we think of our health records being used by others, we need to separate the uses of the data, in order to understand different ways it is used, who uses it and why. Data once it is processed becomes knowledge which is used as Business Intelligence. It is common in discussion to conflate use in care with care.data. It’s even in the name. But the uses of care.data are secondary. Not to be used by clinicians caring for us, not replacing hospital notes to give to consultants when we are referred for a hospital stay. Not providing discharge papers. It’s only approved for commissioning and sketchily [imo] approved for risk stratification. [ref p.5 ] [8]
care.data extracted from GP surgeries, is not even approved for research purposes, but to read all the recent debates you’d think research depended on it. Research using GP extracted patient data, is not an approved use of care [dot] data. Research using GP extracted patient data is not an approved use of care [dot] data. Repeat, ad nauseaum.
What is already being done, and what is used legitimately i research such as public health (albeit without our past knowledge or consent), is with our hospital data, HES, SUS, Mental Health data, usually with CAG review, and through 251 approval sometimes through DAAG review at HSCIC – it is available and is on sale to all sorts of other non-care providers. And that is planned to continue.
The records extracted so far, when not used for research appear in recent years increasingly used for comparison, the concept of ‘ranking and spanking’ professionals and providers of healthcare. They are also used in commissioning, payment validation and understanding costs and spending. But beyond that, there are all sorts of others who still come under the umbrella of ‘health purposes’ but don’t directly benefit the NHS or individual patients. What is their demand and what are they being supplied?
In the newly created NHS marketplace, customers at individual level are patients, or at a market level they could be any part of the healthcare buying structure, a GP practice, a Clinical Commissioning Group, a Hospital Trust.
The challenge of any demand and supply chain process, is that you need a market willing to pay at the price you are prepared to sell. And you need to offer what they want to buy. For that, the buyers must see a value in the data they want to obtain. Where is the value for these areas of use: Generic NHS Business Intelligence, Generic Commercial Intelligence and Pharmaceutical intelligence?
Health records as Business Intelligence
Some companies take data and process it before selling it to NHS and other health providers in England. This provides a third party service and skill set which the HSCIC nor the NHS Trust for example, has themselves, such as IMS Health.
So business intelligence used for the benefit of the NHS, makes sense and is necessary to a greater or lesser degree depending on your attitudes to comparison websites, green/red flagging professionals and commissioning. Benchmarking was provided by Tribal until that part of their business was bought out by Capita.
These companies’ experience and market is healthcare. The kind of knowledge they can give to the NHS is highlighted in their case studies.
So for clinical care, and for commissioning at individual organisations, these tools are clearly useful and use individual patient level data. [9]
Al sorts of other places and individuals perform these services. They include a wide range of commercial organisations, small and large.
Health records as Commercial Marketing Intelligence
Commercial buyers however, can include wanting data for identity verification, fraud prevention and background checks. Services such as Experian offer. These may be what the loose definition in the Care Act would say are now banned, but are they? What is to say that a company which offers the use of private health services, healthy eating or pharmaceutical marketing is not providing information to others, for the promotion of health?
“Experian employs more than 12,500 people in 34 countries worldwide, supporting clients in more than 60 countries. Annual sales are $3.1 billion (£1.7bn/ v2.5bn).”
Identity verification can be done, matching data across a biographic footprint, ” in databases, established for 45 million UK citizens and hold in excess of 1 billion records.”
“Experian public sector currently works with 380 plus local authorities, 52 police and investigatory bodies, as well as central government agencies including DVLA, HMRC, DWP and the Cabinet Office.” [10]
There is clearly a lot of data sharing in the public sector, about which we may understand very little. But mostly the buyers of data want to sell something. Companies buy lists of people to use in marketing campaigns, who might be interested in what they’re selling — and companies also want to learn more about their current customers.
This is where I find the level of detail and what is done with our data, more than a little freaky.
Every UK consumer is classified into one of 22 types, aggregated into six groups. The 22 types are linked to six decision-making styles, providing insight into consumers’ motivations when using different media and the processes they go through in deciding about products and services.
I don’t know what segment I am in. But I know that I will have data stored in many of those different data sources they mention. So do they actually know more about my habits and inclination, that I have self-awareness? If their tool has over 850 million input sources which they process, it’s more than likely. 34 million email addresses, 20 million mobile phone numbers, 49.7m names and addresses.
Experian may well have much of this data from the electoral roll (unless like me, you opted out of these uses) but in the HSCIC January-April 2014 register of releases [7] data was given to Experian for use in Mosaic. (see July – 132kb right of page)
“Mosaic is Experian’s powerful cross-channel consumer classification designed to help you understand the demographics, lifestyles, preferences and behaviours of the UK adult population in extraordinary detail.” [12]
That they understand and track my behaviours probably better than I do, and at such detailed level, I find surprising and invasive. In fact, I find it threatening in a similar vein to the visceral reaction that the Facebook experiment generated this week online.
As SF Gate reported,
“Using unsuspecting members as human guinea pigs is repugnant. And when the biggest social network on the planet does it, can its leaders be trusted with their own technology?”
This idea that just because one can and the technology permits it, does not mean that one should. It just feels wrong to find out others may manipulate our thinking and behaviours in such a targeted way. Just as Experian does with consumer data:
“Within rural areas we are able to pick out the individual households that are likely to be commuting to towns and cities nearby…”[12]
Individual households? Understanding my behaviours, gives them information which they use to nudge or influence my decision making. Understanding our behaviour ‘in extraordinary detail’ helps companies market and sell more to customers.
There are other re-uses even for health purposes, which seem less transparent and more about us as general consumers, rather than for our health. For example, the use of HES data is in social marketing targeting:
“In this way, companies who process data such as Beacon Dodsworth received data in the last year and offered it for commercial exploitation by others “HES data may be used by pharmaceutical companies “to improve [their] social marketing / media awareness campaigns”. Others included OmegaSolver and Harvey Walsh.”
These companies have re-use licenses for data. what that means is better explained here by medconfidential. [14]
How will HSCIC know how data will be used after release and how will it be audited and how often? When it comes to human tissue, the HTA only audits tissue banks in the UK once every three years. That’s a long time in between audits if something has gone horribly wrong in best practice.
Health records as Commercial Pharmaceutical Intelligence
To global pharma it is again not the data itself which is of value, but in the knowledge it reveals. The pharma business intelligence. It can show at an individual level what is being prescribed or show any gaps it reveals, which will allow pharma, to address ‘unmet clinical need.’ The data already compares hospital prescribing and reports make recommendations used by NICE on what drugs to use and recommend. My concern is that to treat the worried well who have cash to spend, will deflect attention from the needs of the sick and poor and that even if only at postcode level, we will be targeted for pharmaceutical marketing.
“The parties will initially look at how anonymised, integrated health data can be used to identify unmet clinical need in patients with diabetes. In the UK, diabetes affects approximately 2.9 million adults overall, with more than 90% of these patients having type 2 diabetes. This makes diabetes one of the most common chronic medical conditions and represents a significant strain on U.K. health services.”
Astra has another Memorandum with IMS Health. So we, whose data it is, have zero transparency and can request no accountability for the use of our data once it has left the HSCIC.
And it matters because when there are data breaches in these companies, we should know whether our data has been involved.
In January 2012 AstraZeneca signed a three year partnership with IMS MOU[16] and stated it builds on AstraZeneca’s existing ‘real-world’ data and research partnership with HealthCore in the US, the health outcomes research subsidiary of WellPoint. Wellpoint which had a massive breach a year ago, July 2013. So how do we know where our data was stored, and if it were involved or not? Here is what pharma use data for, to analyse “unmet clinical need.”
“The partnership with IMS Health will give AstraZeneca access to pre-existing anonymised electronic health records, which include clinical outcome, economic and treatment pattern data. In addition, the companies will jointly develop a customised research and data analysis platform. The information will provide a deeper insight into how medicines that are already on the market are working in real-world settings across Europe, painting a picture of unmet needs …”
We can look at this more than one way. Some feel strongly commercial use should exclude Big Pharma. On the one hand, the State and Government does not own manufacturing of drugs nor medical products. Though we used to do both. Recently, that we did own, has been increasingly sold to commercial buyers or venture capitalists.
The State and pharma work together, often through University research, to create future health solutions, drugs and the drive towards personalised medicine and diagnostic tests. When companies which own our data are sold and bought internationally what happens to our data they own? Boots Alliance bought data from HSCIC, and they are about to be bought by US Walgreens. So many questions.
Those more informed than me will know all about the challenges of pharmaceutical companies, the patent cliff, mergers and diversification. IP, diagnostic tests and generics in the market. Big Pharma and the State are working together in much research to find solutions and discoveries to current and future medical issues.
How far does cooperation stretch and when does it become inappropriate? Is commercial interest supportive of State practice or driving decision making policy? Should commercial companies fund any costs at our NGOs? And do those which buy the most data, get a bigger slice of the influence of what conclusions reports using the data, reach? Whilst there is a public move to #Alltrials I believe we should demand #Allreports in the public interest as well. I would like to have transparency at HSCIC how their reports are funded, when working with partners which are frequently commercial pharma partnerships.
Mr. Hunt recently defended to the Health Select Committee the reasons why a commercially supported pharma lobbying group was used to advise on the NHS Commissioning plan – the Specialised Healthcare Alliance. Supported by 14 pharma companies, these corporate members are contributing £12,000 each towards the costs of the Alliance for 2014.
Are we really seeing transparency on who is driving change in our health service?
The Richness of our records open for Exploitation
The value of Big Data is only extracted by exploiting its richness. And these days, with mobile phones, social media and shopping habits tracked by the minute, the average citizen like me, it seems can’t easily avoid being part of it, whether we want to be or not.
But if we don’t even have the right to control and own our data and we can’t control the knowledge generated from it, how can we control who knows what about us and what they use it for? If we’re unaware of its existence, how can we understand its impact on our life to make free and uninfluenced choices in what we buy, for example? Or understand how we may be segmented and discriminated against. And this is aside from the assumption that the data held is accurate and that as a result, no mistaken judgements are being made about us.
As for our health data, how can we control its use by these massive data managers if we don’t even know who they are at the end of a chain of re-use licenses?
Put Business Intell, Commercial Intell and Pharma together
The vast amounts of data already held and analysed to the nth degree by these data intermediaries, means that making even more data available to them is going to increase the segmentation and risk of identification. They already have data on individuals and is it not enough that they make analysis at household level as shown by Mosaic? Individual health level data seems that they could put a final piece in the puzzle and know exactly who in which house had which ailments, their lifestyle risk factors could be refined and these data brokers would be able to look inside our very bodies.
One which fits data together, we do know from the HSCIC data release register, and press reports in March, is Harvey Walsh. The company tracks individuals pathway data, over time and the website now says:
“Harvey Walsh use non-sensitive and non-identifiable HES data for patient pathway mapping that is used by the healthcare industry with the NHS to improve the quality of healthcare management and service delivery by better understanding how patient cohorts move around the healthcare system.”
[Harvey Walsh’s system] “AXON holds non identifiable and non-sensitive HES (Hospital Episode Statistics) data and other sources of data including GP Practice Prescribing, QOF, Demographic and NHS personnel data sets.”
Data snapshots combine to give a Picture over a Lifetime
So now, not only can these companies understand us in infinite detail, but can do so over our lifetime. We are tracked over time and anaylsed not as a snapshot, but as a living album of snaps, moving across time. They know what we do commercially, in our lifestyle and how it interacts with our health and what may affect our consumer habits and help nudge our decision making. Put them together, and it starts to feel like I’m on The Truman Show.
I’d like to know though, once the data is processed, what happens to the new combined knowledge set, it creates? The original raw data as extracted may not be given to others, but is it the same product and protected, if it now shows up as a small piece, in a bigger jigsaw?
Omega Solver took their product offline this year, after privacy campaigners identified the risk of identifying individuals.
Acxiom as a world data leader example, is a company which provides consumer data and analytics for marketing campaigns and fraud detection. Its databases contain information about 700 million consumers worldwide.
“For more than 40 years, Acxiom has been a leader in harnessing the powerful potential of data.”
It seems others share my concerns, as this article on how data brokers use of our data is creepy, from Julia Angwen showed up in my alert feed this week, and another in ProPublica from last September. As she says,
You can see more on this, in her interview with PBS News:
Our lifetime data is attractive to commercial marketing and all sorts of organisations who wish to understand us and sell to us. The one purpose, possibly the least trusted I have not really touched on. Hospital records have been shared with insurers and used for refining policy. Records have been sold to re-insurers, even since January 2014. And these insurers mine and use data much more deeply than we want to imagine. In fact, as I finish this I see the FT front page tomorrow carries a current story how insurers trawl our Big Data.
FT Insurers trawl Big Data
HSCIC Data Sharing Agreements will prevent Data Merger?
IMS Health UK & Ireland’s general manager, Michael Sanvoisin shows that exploiting the different data sets ‘out there’ in Big Data, is kind of the whole point. [17]
“The smartest use of data will be the effective combination of all the various sources of open data and patient information services available in the marketplace, augmented by companies’ own internal information and data from other reliable and reputable sources.”
IMS Health is working in partnership with the MHRA – and in particular the clinical practice research datalink (CPRD) – to help the UK increase its capabilities to build cohorts of patients for clinical trials. This has led to the linkage of IMS Health’s Hospital Treatment Insights (HTI), the aggregation of HES and prescribing data, to the CPRD. This powerful linked dataset enables the identification of specific patient cohorts and allows companies to monitor patient flow between primary and secondary care. IMS Ardentia’s Costed Care Pathways (CCP) sequences clinical events together with detailed financial information to give a longitudinal view of a particular patient care pathway.” [17]
When these global companies have in addition, bought data from HSCIC, where is the transparency for patients to know what internal practice at these private companies prevents all data becoming one Big Data set, in identifiable or pseudonymous formats, and sold or shared onwards with others?
The Recent register states explicitly, that IMS will not do this, that the data will not be sold onwardly, but how about theknowledge they create from it?
“ANDromeda is an engagement tool enabling greater market access with a tailored need across all functions within pharmaceutical companies.
And in the UK, are involved in work shaping our health market: “that may involve looking at how primary care organisations operate or focusing even closer on area-level commissioning, such as GP consortiums.”
Where is our Data being Used?
“The effective combination of IMS Health’s proprietary data assets, in addition to the vast swathes of open data being made available, can help inform key strategic decisions for both the NHS and pharma. Moreover, it can drive an increase in joint working towards shared benefits and therefore transform healthcare services in the UK and beyond.”
“in the UK and beyond.” So I ask myself, which countries outside the UK have received our medical records? Remembering that non-US citizens have no privacy rights in the US, if it landed there, we can say good bye to ever getting control of that knowledge back again.
Indeed HES extracts have been given to places in the US, specifically the University of California, the FOI request I got back confirmed. The Partridge Report contained two examples of data which has gone to Kyoto University. Yes, Japan. And remember, if the data is completely aggregated and anonymised it’s not included in these registers, because it is open, green data. So what exactly went to California, Japan and who knows where else. No one knows 100%. The Report only sample tested 10% of all releases.
IMS received 251 access (which is required for confidential data without consent) for identifiable data extracted from hospital pharmacy systems, sent to HSCIC and linked with HES (hospital records). The main customer for these products will be the pharmaceutical industry. (Lines 101-2).
IMS Health is massive, as is the global health data they hold.
On the IMS One intelligent cloud, the company connects more than 10 petabytes of complex healthcare data on diseases, treatments, costs and outcomes to enable our clients to run their operations more efficiently.
Drawing on information from 100,000 suppliers, and on insights from more than 45+ billion healthcare transactions processed annually, IMS Health’s 9,500+ professionals drive results for over 5,000 healthcare clients globally. Customers include pharmaceutical, medical device and consumer health manufacturers and distributors, providers, payers, government agencies, policymakers, researchers and the financial community.
Another user of our data is Optum UK (formerly United Health Group, and if that sounds familiar it was Simon Stevens [18] last employer). I wonder for example, does that mean it is also used by Optum Insight in the US? This presentation by Christopher M. Blanchette, shows different data providers of ‘RWE’ real-world evidence and where their data is sourced.
If international companies have NHS England patient data and re-use licence, is it likely in to have been exported around the world or how can we know in which locations it is used? I want to know how often data is given directly to International companies? How often is data given to companies in the UK, who have foreign centres outside the UK, which would routinely share that data with their central systems and therefore export it? It is a basic right of data management to require fair processing for identifiable data, to know who has it for what purpose.
How do we protect consumers’ concerns?
And as US Commissioner Julie Brill’s report shows, in the States there are concerns how this data is used and they are acting on it. Are we doing the same here?
Dr.Neil Bhatia in Hampshire, a GP who founded the non-commercial website care-data.info, asked HSCIC in an FOI request for the data *about him* which was released to these type of intermediaries. He was told, the data controller, the Health and Information Centre, does not know. And he can’t ask for what data is held in pseudonymous format – even though the data is pseudonymous with a key to make it linkable with new identifiable data coming in, so to me, that makes little sense. It is by its nature, re-identifiable.
But if HSCIC won’t release it in a Subject Access Request (SAR), we can then only surmise, whether our individual data was contained in bulk data transfers. So from the released data register, we should look at what types of companies are using pseudonymous (so called ‘amber’ data), and assume our own data was indeed included.
Overseas Data Distribution and Protection
care.data, it was said at the Health Select Committee meeting by Mr.Kelsey in March, was only for use in the UK but the HES/SUS data application form includes a field for use overseas. So, does that mean policy for export has changed for all data, or should they have spoken more precisely meaning only that “GP data extracted in care.data” was only to be used in the UK?
Because IMS, again, already has access to primary data from CPRD and secondary care data according to line 10 from HES. And whilst, it states “[Note added 28/3: The data are onwardly released only in aggregate form] I am curious – where does ‘onward’ mean? There is no Ltd. on the company name, no territory or geography indicated in the register. So if data is released to an American firm, should we assume it sits on US servers and is accessed directly by their US staff? Does onward only restrict them from giving the raw, identifiable data they received, to others outside IMS? Is it availble in non-aggregate form inside the whole of the IMS system? I, in the general public, can’t tell from the register and IMS is hardly going to tell me. We should be able to find out. I’ve found it a challenge, and my FOI request to HSCIC [14] to find out what data may have been given to US or Asian organisations, was tougher than my entire lifetime of dental appointments combined. It shouldn’t be difficult. Patients should be able to easily ask, to whom did you give my health data and where, for what?
Do we know enough about the plans to use and commercially re-use our data for commercial ‘health purposes’ as being broadly defined in the Care Act? If not, patients should be asking. GPs don’t have time.
Why does it matter? Because legal jurisdiction of data is still (perhaps outdatedly) physically geographic at least in aspects with which I am familiar. When working on global implementations of confidential employment data, we had to gain legal advice from each territory submitting data, on how we should legally properly manage data from over 50 countries in the world and its access by regional and global teams in the US, Europe or Asia. And on simple terms, we should always handle, process and use data in a way the individual expects and feels common-sensed appropriate to the purpose for which it was submitted. British citizens are not protected by US privacy laws because they apply only to US citizens.
“Existing laws do not sufficiently address data brokers’ handling of sensitive data in marketing or risk mitigation contexts,”
says Julie Brill’s statement. Well they don’t protect us Brits, at all, so I want to know if it’s being used abroad.
Few in England, will expect their data to have been made as freely available at identifiable individual pathway level, as it appears to have been in recent years. Do I at least have the chance to protect my children’s future data privacy, if not my own now?
Surely we can trust Data Protection Laws?
Because of the legal status of data which is deemed “de-identified” or “anonymized”, it is claimed they don’t violate our rights to health information privacy – Data Protection law accords us only the right to fair processing, not to prevent its processing, due to the the Health and Social Care Act 2012 which requires its extraction — but if it’s possible to re-identify longitudinal data sets – and if the whole point of getting these data sets together is to combine them, surely common sense would say, it may be legal, but that doesn’t make it right. There are other DPA expectations which HSCIC also fails to meet. The Minimum data required, for example. Deletion. Accuracy. I am guessing that every single one of the eight Principles have been broken by our data extracted before the HSC Act 2012. Yet, everyone seems to be ignoring this.
When it comes to Data Protection, identifiable data is treated differently from anonymous data. Amber individual level ‘pseudonymous’ data, is not the same as aggregated anonymous statistics and the care.data privacy impact assessment [19] confirms the risk of re-identification, yet the data is being treated as if it is anonymous. I can’t believe people working in the field believe themselves these data groups should be looked on as being equal. In my opinion, it’s not so much a case of wearing rose-tinted spectacles, it’s more like a blindfold on the wise monkeys; hear no evil, see no evil. [20]
I can quite clearly state on behalf of many, we feel that our rights to privacy have been and continue to be violated, no matter what the letter of the law says.
Whilst HSCIC may see only its own data sharing practices in a silo, that’s not how the impact of its sharing works in real life. It’s a join the dots between different data sets from different sources.
Can Good Governance Give us Confidence?
We are told that data-sharing agreements make it illegal for the data to be combined with other data held by the recipient, to make it identifying. But if the Data Controller doesn’t know what data the company already has, and doesn’t even keep track of what data has been given to them already, it must be impossible for individuals within these massive corporations to know the impact of adding their piece of the jigsaw puzzle. Over time, they will not track either, what from their company has already gone into creating the Big Data picture.
We could only rely on release controls and good governance, but for the past ten years reported in HSJ and the Partridge Review, it appears some datasets have been inappropriately shared without audit, which would have spotted the mistake. Governance is simply inadequate. In my opinion, not with malicious intent. Rather, simply, the data sharing strategy has been too fast for its own good practices to keep up. Now, it has to catch up fast.
As awareness increases, so too is the push back on the privacy grab. How do we feel about losing our individual rights, the removal of confidentiality and consent, the right to freedom from cold-calling, and to know who has our data for what reasons. And do we feel the same if we lose those rights in the name of commercial or public interests?
The British public is pushing back on banking failures and resents increasingly to see the minority of individuals benefiting commercially at the expense of the many. We resent the paternal state definition of the ‘Public Good’.
The public interest considered by CAG in reviews of data release applications, must consider protecting both the public interest in research access to confidential patient data and the public interest in a confidential health service. Add to that the public interest of providing a national health service, and its safe to say ‘the public interest’ will be hard to satisfy for all of the people, all of the time and will be subjective.
“that the purpose for which the data will be used should be in the public interest and for the provision of health and care services; [and] that any approved processing must respect and promote the privacy of patients and care service users… ” (Hansard, 10 March 2014, Col.137)
Perhaps even more subjective, is the atmosphere of public interestand how interested the public is, in how how level decisions affect us on the ground. Certainly, Snowden and other data sharing revelations have coloured the muddy backdrop of how our data is gathered and used by others, and increased calls for transparency.
The Department of Health will be furious with the Home Office I expect this weekend, as they triggered a massive outcry over the perceived lack of transparency and scrutiny afforded to MPs and civil society over the Data Retention and Investigatory Powers Bill. Even Radio 2 gave it 20 minutes coverage. [22] (From 01:36.40) This kind of governmental out-of-touchness with the public and the perceived desire to hide something in the rush to the new legislation, is what undermines trust in all areas of the public-state relationship.
It implies a paternal notion, of “we know best, so just trust us little children.” Well, that ain’t gonna fly. Seahaven is not “the way the world should be.”
Patient empowerment to own our Health Records
This flawed process, within and beyond NHS data sharing, has also created a sense of loss and disempowerment. Whilst presentations are all about ‘patient centred’ care, and ‘personalised medicine’ sounds so about the individual patient, it seems safe to say patients have been left out of the digital decision making and sharing how those decisions will affect the public on the ground. This for care.data, should have been central to plans to ensure support and success. There are still unfilled positions supposed to be filled by patient organisations or patients on the tech board.
It seems endemic to new programmes too. Or have patient organisations been widely involved in the genomic plans for the nation and not told us? Unlikely.
The talk thus far, does not match the walk. Knowledgable patient involvement is as desired by some of those leading parts of NHS patient engagement, as a chocolate teapot is useful. One is documented having said on another programme, “this was not a suitable point for patient involvement.” Either you want patients involved or not. Involved means from the beginning. Not as the decoration at the end, a way to tick the engagement box.
The notional idea of patient empowerment in this programme is tokenism, if the most basic principle of care, the only thing I can control in my consultation – my patient confidentiality – is treated with such little respect.
Is the public good really defined and does it outweigh the private good and our long established rights of consent and confidentiality? Does it vary depending on circumstance and if so, who decides?
It certainly doesn’t seem to be us, the patients in healthcare. Nor as citizens in any other field of our personal data.
If you don’t pay for the product, you are the product
In general commercial uses of data, I am increasingly learning that if you don’t pay for the product, you are the product. Maybe we need to shout a bit louder, that we are not a product. We do not all want the knowledge of our health & lifestyle to be for sale.
We’ve got used to these third party uses through the recent media revelations and the acceptance that current Government seems to be prepared to sell anything the State has in its possession. I wonder how representative that is of what the people would choose to do?
So at the risk of repetition, let’s not forget the basics:
The list of past customers in the Partridge Review of those who received data before April 2013 shows the extent of what was hidden from us for twenty years.
Should we be asking, what may be hidden still?
By stretching the scope of the potential discussion around the ‘industrialisaton’ and use of our health records for secondary purposes, we must not normalise the basics which we at first, found so surprising. We need to get them fixed first. Then, only then, will patients be willing to look at broader future scope. If I can’t trust you to manage my hospital record when I broke an ankle, why would I want to trust you with my genomes in future? It reveals a complete disconnect at NHS England level with the public in care.data thinking.
Come back to reality and listen to patients’ real concerns. We don’t want our data given to third parties, these data brokers and intermediaries or to continue re-use licenses. Even if it’s for ‘the promotion of health’ the purposes in the Care Bill.
And honestly? NHS England and the Department of Health shouldn’t want that acceptable in policy either, because they need to know who has our data, to govern it to make sure it is acceptable. As Sir Nick says in his report, the future data governance must be:
“meticulous, fool-proof and solid as a rock”
One more big mistake in who received our data in the future, and all cards will be off the table. For this to work, you need to properly manage it. And all this at the time where NHS England has now decided to outsource population wide databases, through the Steria outsourcing. Ha. Get that outsourcing security wrong, and for all your future programmes, as Truman would say, “Good morning, and in case I don’t see ya: Good afternoon, good evening, and good night!”
In the words of more Americans for whom I have a respect & love of their self-determined own words, Simon and Garfunkel, ‘Slow down, you move too fast.’
Julie Brill’s Statement made a recommendation in the US:
“A second accountability measure that Congress should consider is to require data brokers to take reasonable steps to ensure that their original sources of information obtained appropriate consent from consumers.”
We should feel that we consent to this mining of our health, wealth and lifestyles and know what is done with that knowledge. I feel disempowered because in finding out how my health data is used, I’ve discovered a brave new world of how my personal data is used. By commercial business. By Government. By suits and wonks as may be nicknamed. I am not equipped or informed enough to understand it all, but I’m doing my best to find out.
We need to trust in the people who manage these systems, who drive the policy and who advise the two, to work together and make technology work well for the rest of us. It should work well with privacy and security, and functionally.
Patients must speak up and Ask Questions
Patients must start asking more questions about these commercial uses and re-use licenses, because whilst the commercial intermediaries may access data for the purposes permitted in the Care Act, we are not a partner in patient engagement. Our data is being mined in the name of NHS improvement. Our samples being gathered in the name of science.
We are the product for sale. Our name, and everything else about us.
[3] Health Select Committee July 1st, 2014: http://data.parliament.uk/writtenevidence/committeeevidence.svc/evidencedocument/health-committee/handling-of-nhs-patient-data/oral/11192.html
[9] IMS Health Ardentia http://www.imshealth.com/deployedfiles/imshealth/Global/Content/Technology/Technology%20Platforms/Ardentia/Ardentia_Royal_Free_PLICS.pdf
[10] Experian Public Sector http://www.experian.co.uk/assets/identity-and-fraud/authenticate-for-public-sector.pdf
[17] IMS Health using NHS patient data http://www.imshealth.com/deployedfiles/ims/Global/Content/Solutions/Healthcare%20Analytics%20and%20Services/Healthcare%20Outcomes/IMS_HTI.pdf
“My concerns about care.data are heightened, not allayed by the NHS England apparently relentless roll-out and focus on communications. Whilst they say it will take as long as it needs, there is talk of Oct-Nov. pilots. It is still all about finding the right communications, not fixing flaws in core concepts.”
Patient participation in general practice: exploring how can you be involved in the changes in general practice, including the introduction of the Friends and Family Test and changes to the GP contract in relation to Patient Participation Groups.
Patients Online: This session was to enable attendees to find out more about work to increase the number of patients who can access their health records online, book GP appointments online and order repeat prescriptions. The accompanying film was described by a fellow table guest as, ‘awful. Too long, dull and dry.’ It felt that there was a lot of weight given to this part of the day and that the uses of data during the event were all mixed into one pot. care.data will not be the source for patient online access, yet we came away thinking of the data as one source to enable that purpose. Poor communication or clever marketing, will depend on your point of view.
The big picture however, of how our health records will be used and bring benefit is in my opinion, being manipulated and purposes conflated to make one thing seemingly lead to another, which are in fact unrelated.
care.data is for secondary purposes, not direct care use by physicians for example. We are told this sharing of data is a requirement for other things as well. Firstly for patient safety and quality. And for integration between services.
Integration
Mr.Kelsey said at the Open House day, (around 36:00 minutes in, if you listen yourself) “we’ve all heard this word integration, I’m not terribly sure what it means, but I think what it means is that local people have a proper say in the way that health services are designed. So to give you voice, to give the local community voice, care.data is really important….”
I should hope that Mr.Kelsey has a jolly good understanding of integration and knows exactly that it is the merging of health and social care under the motto ‘transformation’. Social care under ADASS and health care are under all sorts of pressures to integrate, budgets are being pooled, shared and ring-fenced in various discussions, including my local county Health & Adult Social Care Select Committee:
“…Director Adults’ Services, told the (Chichester) Committee [9] in November 2013: The Care Bill would mean a radical whole system change involving the biggest ever transformational change for Adults’ Services The Council was building the foundations for further significant change.”
Perhaps on the day, he meant something else.
Mr. Kelsey did, in his speech note however, that the programme should be respecting the fact it is *their* data, *not* the NHSs. (This is in contrast to his previous position in which patients should not be given an opt out choice – Prospect Magazine, 2009 when his stance was “no one who uses a public service should be allowed to opt out of sharing their records. Nor can people rely on their record being anonymised”).
It’s an argument oft repeated that we should *own* our data, but somewhat meaningless if it took a campaign and public outcry to require an opt out mechanism, and put the programme on hold. I feel the language is being manipulated to create the impression we don’t already own or have rights to our health data. The opposite is true. And many know that, just see the killer question below from Leicester. As long as records are held only at GP level, we will have much greater control and visibility of their use, than if shared centrally.
Many I have spoken with ask why it is not possible to leave data at local GP level for only clinical care, and extract nothing identifiable from hospitals without consent?
Other People’s Questions
In that vein, I summarise what 4 other people asked Mr. Kelsey and his panel in London about care.data on the day, and what I felt was missing from the answers to give balanced communications. The locations of about 80-100 people at each, were each allowed to put forward one question to the panel via web link, the question selected from all those discussed at the tables, by an organiser at the site. They covered Benefits / Data Uses / Confidentiality / Communications.
View them for yourself here, from 01:13.06 in the NHS Open House video:
Question selected to be asked from Basingstoke: “If people opt out of giving data will then the results not then be inaccurate?”
The larger volume of data, the better quality the data will be, the greater the benefits will be. Choosing not to opt out. That will, depending on the volume of that, affect data quality to a degree we won’t know that. Over time, once people’s concerns have been addressed, we hope that quality will improve.
Missing from the answer: [10] HES data is cleaned, SUS data is not, and both are known to have significant quality issues on validity and accuracy. The data has been extracted and stored for twenty plus years. Higher volume of data does not equate with a higher quality of data. You don’t make a better quality haystack, just by adding more hay. The volume of data is less important than it be representative of all parts of the population, but there is a risk that those opting out tend to be, as one GP has told me, ‘the white middle class and educated leaving others overly represented’. Only having more data is not a solution for quality.
*****
Question from Leicester: “Are we saying there will be only clinical use of the data – no marketing, no insurance, no profit making? This is our data.”
Panel: New legislation was brought in which made it very clear, data could only be released for the benefit for health and care, and it cannot be released solely for commercial purposes – yes, data can go to a private sector organisation, yes commercial companies, but only where they are working for the benefit of health and care, for example, Dr.Foster Intelligence, or other data information intermediaries who do a lot of work with data and who do a lot of work with the NHS to help inform decisions. Data will still be available to commercial companies. The other point, there is going to be independent scrutiny, which will be formalised within the law, to have independent scrutiny by the Confidentiality Advisory Group, which already exists which can independently scrutinise the releases.
Missing from the answer:care.data is not for clinical care. This indeed is our data and belongs to patients not NHS England, and should be respected as the NHS Constitution requires. Data continues to be released, and will continue to be so even under the Care Act legislation, to third parties in financial transactions. No recipient organisation by function (such as insurance) is excluded per se, rather recipients are judged based on their intended use of the data. The precise terms are open under the Act :
****
Question from London: “How do you propose to reset expectations and perceptions, with any future communications, and given that the way the first round was handled, provoked apparently such strong public resistance and suspicion about the NHS England motives?”
Panel spokesperson: We didn’t get it right the first time round, partly because we approached that at the National level. There was a leaflet that went out nationally. We will work with the 100-500 GP practices, and work co-produce materials in those areas and work with what is already there locally, GP practices, LMCs, PPGS, Healthwatch, using local knowledge, and patients so we can make sure everyone can understand, we understand how we can communicate this, what the concerns are, so we can get the message across, so everyone can understand what the choice is and what this is about.
Mr.Kelsey added: …[…]This isn’t about us and you, this is about us collectively. How do we ask patients and citizens for permission to use their personal information…we need to get that conversation right.”
Communications materials
Draft FAQs and information sheets to use in those conversations were on the table for participants information and to take away. The Data Uses page wording is interesting but poorly phrased, as it misled a couple on my table to think the ‘extraction’ was not identifiable. (see point 9 above). And the Benefits case study header is “How might it reduce variations in cancer treatment & care” but concludes that actually the Cancer Registry already does this, and they instead mean something similar would be useful for diabetes. This misuse of benefits makes me think, they’re finding it jolly difficult to find real ones. But if we all at these public meetings, believe the presented stories with the positive spin as fact, then fact they will become.
“And if all others accepted the lie which the Party imposed—if all records told the same tale—then the lie passed into history and became truth.” (George Orwell, 1984)
What next?
It is vital in my mind that care.data communications match reality of what needs done technically and in procedures, to drive expectations of what care.data will deliver and when. Why does an easy read brochure make no mention whatever of who data may be sold to? There is no mention of what organisations continue to receive HES and wider data. Instead it talks about data being shared to ‘know the health needs of everyone’ yet the very people who are outside the system are the ones whose needs we don’t know today – there is a huge amount known from the rest of the existing patients’ needs from QOF and other GP data extractions, even that used in CPRD for research – purposes for which GP records under care.data are not approved.
The current doublespeak between the comms message and the reality are so far apart, between the technical possibility of what can be done well now, and what needs done to achieve the hoped for benefits, that the current message is setting up the project for failure and benefits will not be realised any time soon. It’s not ready to roll out through ‘improved communications’.
To be fair, the smaller workshop I attended on the 27th, flagged ‘still need to consider how best to engage here’ with many population groups. But it appears to me the Communications teams are effectively doing their best to package something which is not ready to be wrapped. To dot the i on the report, when the chapters aren’t in place yet.
“They were engaged in producing something called an Interim Report, but what it was that they were reporting on he had never definitely found out. It was something to do with the question of whether commas should be placed inside brackets, or outside..” [1984, George Orwell]
I’ve worked on both technical and change management/ communications teams [in another industry]. Project teams’ close working and each having an understanding of the other is vital. But the team members I have met so far, appear to work in silos, without enough linkage to know the functional gaps between them, in technical system, procedures and the link to change & comms. There is no way in my lay opinion, that a pilot of these half-formed knowns will be ready for autumn. For the NHS England leadership to continue to plug that it is, with messages of emotional manipulation of why more data is needed, will condemn care.data to Room 101. A tortuous drawn out reformation of an existing concept. When really it needs planned afresh from the ground up to get the needs of the people it should serve designed into its consent, collection and communications processes – not added on as the ribbon at the end.
I was more optimistic about the benefits in the past, as long as the procedures around consent, governance and security were addressed. Having spoken with and listened to the needs and concerns of various charity representatives this week, at another smaller event, I am much less so. Their complex needs, people who go in and out of different parts of the health and social care system at different times in their lives, with real concerns around confidentiality and risks have not begun to be addressed. Real issues for all of disclosure to GPs to ensure care may affect us all. But for many of their clients, they have needs which often carry huge trust and security issues which could put not only their medical care, but their faith in the charities and people working with them, in jeopardy.
I may be in a minority, but I’d rather have my factual understanding and ask hard questions than hear only a tailored communications message, if we are to get this right for our public good.
“Being in a minority, even in a minority of one, did not make you mad. There was truth and there was untruth, and if you clung to the truth even against the whole world, you were not mad.” (George Orwell, 1984)
I therefore asked the group at the end of the morning workshop, as Mr.Kelsey had done at the Open House event, how many of the attendees were really comfortable and confident that they knew what care.data was so that they could be a go-to point for questions, or even advocate for the programme as NHS England hoped.
Did they understand what data would be extracted, why and used by whom. About 1/6 raised a hand. That’s *after* the event at the end of the morning spent discussing what issues exist for hard-to-reach, or as one attendee said ‘easy-to-ignore’ groups, and how communications channels will reach them.
One said he did not need to know all the facts to help be a comms channel. Another said he wouldn’t advocate for something he himself did not believe in. It was the first time we started to get genuine cross-group discussion, when in the meeting the table model had been employed again, but for those groups, disabilities, challenges, societal issues are not in silos. Real debate, of hard issues is needed, and yes it’s awkward and might not be able to be ‘managed’ in the same way, but it’s real.
Our group identified a similar basic concept need across their client interests – a rolling consent model which allows opt in and out to change over time. Consent not only for what parts of planned uses the data would be used, but should also consider what parts of the record they are happy to share. Military, youth offenders, teens, the at-risk nature of these groups may mean they wish sections of their history to be restricted if not used for clinical care. And they may wish to share data when under the care of a GP but restrict it again, when under a military one. Or teens may be happy to permit data sharing at another time in their lives, but not permit access to their whole history. The DH Youth Offender expert raised the prickly issue of teen confidentiality and how will consent be gathered when parents may not tell them about the scheme at all, thinking there is ‘nothing to know’. We explained the concept of Gillick to the comms staff and that it’s not about an age of consent in the normal legal sense. What happens if a teen finds out their data has been extracted and wants it removed as teen or adult? We asked about name stored in the Personal Demographics Service and asked why data could not be deleted if clinician and patient both agreed a mistake had simply been made.
These complex and simple core questions need asked to get the whole thing built on a sound and trusted foundation. And they need to be in place for a pilot to make it worth having at all.
If the needs, concerns and understanding of the reps in the room can’t be addressed in a dedicated workshop, how will a remote campaign achieve it for the population at large?
Some at our table asked why the system needs more data when you haven’t managed or used much of what we had in the past? I would also ask what progress is to be expected on unresolved quality and procedural issues with the current systems and data? Simply adding more hay to make a bigger haystack, does not make it easier to find a needle.
No wonder we can ask if it is really not just about commercial uses which comms don’t want to talk about, wonder why you never mention the data linkage service using PDS data [5] held and have concerns of overzealous surveillance by Big Brother.
Some are concerned that patients lose trust in their GP and withhold information. Others about this honey-pot of data for the individual citizen’s security. Professionals have voiced concern for GPs and consultants if factual misrepresentation by statistics used for ‘ranking and spanking’ will adversely impact their decision making and make them more risk averse. In a negative way. Or with respect to waiting times and treatment, the heavy use of data in measurement creates a risk that it is misrepresenting the facts through lack of context or even, as in several high profile press cases recently, that such pressure is felt, that records are falsified.[12]
“And when memory failed and written records were falsified—when that happened, the claim of the Party to have improved the conditions of human life had got to be accepted, because there did not exist, and never again could exist, any standard against which it could be tested.” (1984, George Orwell)
I’m concerned about all of the above. Perhaps holding care.data in room 101 until it is a manageable and explainable concept, backed up with technically and procedurally sound processes, would be the best place for it, for some time to come. Results and expectations create failure if they cannot marry up in reality. This isn’t about communications. If you don’t really know what you’re communicating and can’t get it understood easily, then it’s back to the drawing board.
My concerns about care.data are heightened, not allayed by the NHS England apparent relentless rollout and focus on communications. Whilst they say in doublespeak it will take as long as it needs, there is talk of a Oct-Nov pilot launch. A pilot must test the finished model at small scale, not a less-than-half-ready one. Whilst the public push is all about finding the right communications, what is needed is fixing flaws in core concepts.
Doing without it, and waiting, would be better than doing it wrong.
“If our health records should sail off in the flagship care.data programme, on the sea of commercial Big Data, are we confident that there is consent, fair processing, transparency, accountability, security and good governance? We must know that these basic mainstays are in place, to give it our support.”
“He that filches from me my good name, robs me of that which not enriches him, and makes me poor indeed.” William Shakespeare, Othello
I read this Shakespeare quote last week, not in the original but in the statement Data Brokers: A Call for Transparency and Accountability by US Commissioner of the Federal Trade Commission Julie Brill, May 27 2014. [1] . Since then I have tried to piece together a lay consumer understanding, of how this commercial data market works and how our health records fit in. Experts in data markets and many others will undoubtedly see how naïve it is. But by sharing my ordinary understanding as a mother who is thinking about the impacts of my shopping habits and upcoming care.data decision will have on my children’s future, perhaps I can highlight how trusting we are, and why those governing our data need to ensure the processes around our data are worthy of that trust.
The Commissioner begins:
“Data brokers gather massive amounts of data, from online and offline sources, and combine them into profiles about each of us. Data brokers examine each piece of information they hold about us – where we live, where we work and how much we earn, our race, our daily activities (both off line and online), our interests, our health conditions and our overall financial status – to create a narrative about our past, present and even our future lives. Perhaps we are described as “Financially Challenged” or instead as “Bible Lifestyle.”
Perhaps we are also placed in a category of “Diabetes Interest” or “Smoker in Household.” Data brokers’ clients use these profiles to send us advertisements we might be interested in, an activity that can benefit both the advertiser and the consumer. But these profiles can also be used to determine whether and on what terms companies should do business with us as individual consumers, and could result in our being treated differently based on characteristics such as our race, income, or sexual orientation. If data broker profiles are based on inaccurate information or inappropriate classifications, or used for inappropriate purposes, the profiles have the ability to not only rob us of our good name, but also to lead to lost economic opportunities, higher costs, and other significant harm.”
In other words, organisations, which we may not know store our personal, sensitive or confidential data, use it to classify, segment and label us. In this environment when third parties it seems know more about us than we may know ourselves, it would seem prudent to want to control and understand what data is held by whom and how they use it. Especially, if in her words, “the profiles have the ability to not only rob us of our good name, but also to lead to lost economic opportunities, higher costs, and other significant harm.”
This is why it matters what is being done at break-neck pace to extract and share our health records in England.
I believe we are not yet sufficiently aware of how our data is used by these intermediaries, and if we were, we’d be horrified. We are complicit consumers in how our data is used with minimal understanding. We’re prepared to unwittingly trade a little privacy with the supermarket, to get our discount vouchers through the post. But we don’t look beyond that to understand what price we are paying and how our commercial interests may be harmed, in much more significant ways than £10 discount or a Legoland entry may compensate. Just like our food, the public are complicit [2] in our own downfall, accepting the marketing spin. We don’t understand credit ratings [3] and risk scores, and even if we do, most consumers don’t know data brokers offer companies scores for other purposes unrelated to credit in an onward chain of reselling. Data can be inaccurate, we are unaware of how to manage or correct it, how we are labelled by it, what opportunities it may restrict as highlighted in the report. We should be better informed.
I’ve recently learned how these, “powerful cross-channel consumer classifications help companies understand the demographics, lifestyles, preferences and behaviours of the UK adult population in extraordinary detail.” [4] demonstrated by Experian.
That they understand and track my behaviours probably better than I do, and at such detailed level, I find surprising and invasive. “Within rural areas we are able to pick out the individual households that are likely to be commuting to towns and cities nearby…” I’ll go more into that later.
It has come to the attention of the general public, only in the last 6 months, that our hospital episode statistics (HES) and data from other secondary care sources, have been on sale in this consumer market. As I said in a previous post [5], a year ago, in April 2013, The ‘Health and Social Care Transparency Panel’ discussion on sharing patient data with information intermediaries stated at that time, there was no legitimate or statutory basis to share at least ONS data [6] in that way for commercial purposes:
“The issues of finding a legitimate basis for sharing ONS death data with information intermediaries for commercial purposes had been a long running problem…The panel identified this as a significant barrier to developing a vibrant market of information intermediaries.”
The HSCIC at that time saw a “vibrant market of information intermediaries, for commercial purposes” using our personal records as desirable and indeed, as Sir Kingsley Manning’s comments to the Health Select Committee demonstrate, in their DH handed-down policy remit.
In this way, companies who process data such as Beacon Dodsworth received data in the last year and offered it for commercial exploitation by others “HES data may be used by pharmaceutical companies “to improve [their] social marketing / media awareness campaigns”. Others included OmegaSolver [7] andHarvey Walsh [8].
Some of that data goes back into our health market as business intelligence, both for NHS and private use, for benchmarking, comparisons and making commercial decisions. In our commissioning based marketplace [9], now becoming normalised.
Through the press earlier this year, and the first data release register [10] we have come to understand in part, who is using it and at least in part, how. Aside from bone fide public health planners and health researchers, and the intermediaries using data for commissioning support tools, recipients include these commercial companies and third-party intermediaries exploiting the data as a commodity. Organisations which may buy raw data and sell it on, or process it and sell that data mined information onwards. Organisations after which, Chair Kingsley Manning told the Health Select Committee, [11] we have no idea whom all the end users may be. He indicated the progress that is needed and that HSCIC is already working on improvements, stating the view that “the process HSCIC inherited was no longer robust. ” Q285
“Kingsley Manning: I realise that, and may I come back to that? That is why, specifically with regard to the sets of data that are covered by data-sharing agreements, I took the view that the process that we inherited was no longer robust. We have therefore been in the process of changing the management and the processes, and we have voluntarily adopted a process of being much more transparent about the process and about the data releases we have made.
Q286Barbara Keeley: But what I was trying to get to was the concern. We are just looking for transparency and honesty here. On all the data that was previously released through these commercial reuse licences where there are end users—the question that the Committee wanted to put to you—you are unable to say what are the uses to which the data release under those licences may be put, what controls are in place and what information is provided—you don’t know. With the whole 13 years of the HES database and however many million records have gone out to one of these providers that then provides on to others—in the United States, this has involved putting up the data on Google cloud, and we are not sure of the security of that—you can’t say. You should admit it now. If you can’t tell us where all that data is and what all its uses are, it seems you can’t. You have already admitted that entirely commercial market uses—
Kingsley Manning: The control is through both the overriding regulations established within the Data Protection Act and the data-sharing agreements that we enter into with people, which specifically allow the reuse of data with safeguards with regard to anonymity.
Q287Barbara Keeley: So you have no idea who the end user is. You have no idea if they are using it properly because there is no audit.
Kingsley Manning: And that is in accordance with the law and the regulations as they stand today.
Q288Barbara Keeley: So, just to be clear, audit is not going to be possible for all the uses and all the end users. The data is out there. You have licensed people to use it and other people to buy it, and there is no control over that—it is just out there.
Kingsley Manning: I don’t accept there is no control. There is control established in accordance with law and the regulations as they are today.
Q289Barbara Keeley: But you are not able to say who is using it and for what reason. You are not able to say that. There are end users out there.
Kingsley Manning: No, because we have a large range of organisations that we have been encouraging. Government policy has for a long time been to encourage the use of this data to advance both the health and social care system in this country and the economy. If, for example, we supply pseudonymised data to a drug company to help it to develop a new drug, we do not know the end users beyond that organisation, but that is perceived as being a task and a function that we have. It is done in such a manner that the data is safe and secure, and is not identifiable back to an individual.
You may wish to change the base upon which we act. We absolutely welcome the suggestion that we should submit these to the confidentiality advisory group. We have identified a number of cases where we think its guidance would be very helpful, including in this area. We would absolutely welcome that, but I am afraid we cannot make up the rules that we act by.”
This is what concerns me, if the purposes and permissions granted for care.data are to be defined by the reason why recipients get data for the “promotion of health ” [12] and that their worthiness to receive data is based on, a wooly, undefined notion of whether it will improve care or promote health. It cannot be transparently judged if many users of data are intermediaries with re-use licences, if even the HSCIC doesn’t know who all the end users are, and does not routinely audit them. Nor can anyone know how identifiable therefore the accumulated data sets may be.
If HSCIC does not track each release, each time, each recipient receives data, how do they know every time a new request is granted, how much of the jigsaw puzzle for any given individual, is left to complete?
If you don’t know who they are, how can you govern them and what they do with our data? How on earth can anyone judge how they will be for purposes in the Care Bill 2014 of:
(a)the provision of health care or adult social care, or
(b)the promotion of health.
How can the data controllers judge whether that release, together with all the data these companies already hold, will not do us ‘significant harm’ in the words of Commissioner Brill, of the Federal Trade Commission? Will it not by its nature of labels discriminate against segments of our society, whom the data owners select, based on information beyond our visibility or control? Is society which is segmented and stratified at risk of every increasing inequality? Disability groups for example, may feel at increased risk of stigma or exclusion. David Gillon [13] addresses this in his post here. How can individuals determine if releasing our data to these companies is in our own, or the public interest [14]?
Impossible if we don’t know who they are, and we don’t know what they already hold. A model which is hardly transparent nor conducive to trust.
Dr.Neil Bhatia in Hampshire, a GP who founded the non-commercial website care-data.info, asked HSCIC in an FOI request for the data *about him* which was released to these type of intermediaries. He was told this week, that the data controller, the Health and Information Centre, does not know. We can then only surmise, if our individual data was contained in pseudonymous bulk data transfers in which there remains ‘a latent risk’ of identification. So from the released data register, we should look at what types of companies are using pseudonymous data. We are also told that penalties may be imposed, or even ‘one strike and you’re out’ for misuse of data. Until now at least without robust audit procedures, I believe we’d never know. So how could data be better secured?
There is talk of a ‘fume cupboard’ access, [15] or giving customers data only in query format, instead of giving out raw chunks of the database. But the Care Bill certainly didn’t legislate for any changes in those types or indeed any governance procedures. We can only wait and see if talk becomes reality and how we can trust it becomes a secure policy and stays so, after we entrust our data. There is no delete button after all.
The Secretary of State wrote on April 25th [16], asking to ensure current practices are up to the task, but as polite as it is, a letter is no form of governance. On June 12th, HSJ [17] reported that the HSCIC has ordered a significant number of trusts to “promptly” delete a series of datafields, which it claims could put patients at risk of being identified, because some of the information in “secondary uses service” that they had submitted to the agency had been entered in an incorrect way over ten years. The good news in this, is it would appear progress is being made in audit, and these errors are being addressed.
However, it highlights the issue created when you release raw data beyond your control. It will mean that organisations who should not have received data, did. How now is that data to be removed from information into which it has become? It will now no longer be raw numbers, but be in graphs, comparative studies and have been inexorably merged with other data. Unlike Cinderella’s carriage, it’s not an automatic process that the raw materials, the data, returns to its previous state after it has become enhanced, turned into business intelligence. The raw files may be traced, removed and deleted, but the knowledge it has turned into, will be almost impossible to find and delete. The links between the two may have disappeared into thin air. Harder to find, than the owner of the glass slipper. An impossible audit trail.
An audit process on leaving the trusts and upon arrival at HSCIC and on leaving HSCIC – at least a three place checkpoint – is what I would have been familiar with in the past for payroll & personal data. It seems that audit procedures for our health records, have just not kept up with the speed at which the data has been sent out on the open seas, and there has been no audit.
“Q287Barbara Keeley: So you have no idea who the end user is. You have no idea if they are using it properly because there is no audit.
Kingsley Manning: And that is in accordance with the law and the regulations as they stand today.”
It’s not to say there are no controls. We are told that data sharing agreements prevent data provided being matched with other data held, which prevents making individuals identifiable. However, as I’ll look at in my next post, I don’t think it even has to get the the person level to be sufficiently identifiable as to be discriminatory. The segmenting of society at group level, at household level, with detailed understanding of our behaviours, is sufficient, aside from the identifiable individual level data these companies hold for identity verification and so on. When companies extract and store raw data, we have no idea where and with whom it lands up. I’ve been completely surprised by what I have learned in the last few weeks how these third parties use our data.
The current controls around and governance of our health data remains unchanged by the Care Bill. Through policy, law and directions the HSCIC has
…”licensed people to use it and other people to buy it, and there is no control over that.” [12]
As Sir Manning said,
…”because we have a large range of organisations that we have been encouraging. Government policy has for a long time been to encourage the use of this data”
Controls may be in line with policy and the law, but I believe it simply hasn’t kept up with the functional need for a decent governance framework.
Julie Brill’s Statement made a recommendation:
“A second accountability measure that Congress should consider is to require data brokers to take reasonable steps to ensure that their original sources of information obtained appropriate consent from consumers.”
Accountability in the UK of these data brokers seems quite absent in real terms, unknown to the public at large.
The same core issue identified by Julie Brill in the US, lack of informed consent. If we don’t know you have it, how can we ask to check if it’s correct or who uses it? In an era of borderless electronic data transfers, we should seek to put in place the highest standards as common denominators, and in terms of privacy, there are lessons worth learning from the US actions post Snowden which in the UK, we have not yet begun.
If our health records should sail off in the flagship care.data programme, on the sea of commercial Big Data, are we confident that there is consent, fair processing, transparency, accountability, security and good governance? We must know that these basic mainstays are in place, and will stay so in future, to give it our support. Well governed data is more likely to get our trust, therefore our consent and be of better quality for buyers.
We must also not forget to clarify why it is our records are needed in the broad and undefined care.datascope that we still have not seen pinned down. Is the public good really defined for care.data and does it outweigh the private long established rights of consent and confidentiality? Do we trust these commercial company uses to do “no harm” as the US Commissioner of the Federal Trade Commission examined?
…”the profiles have the ability to not only rob us of our good name, but also to lead to lost economic opportunities, higher costs, and other significant harm.”
When we visit a medic we are vulnerable, ill or in need of help. We entrust our knowledge in confidence, and trust it will be used for our care. A whole hotchpotch of other indirect uses, including commercial exploitation is not what we expect. We need to trust the data we give away to local staff, is processed appropriately all the way up the data chain, when it is stored, when it is released and beyond. For now at least, it appears citizens can only control the one point at which we first give our data up. After that, we have faith that those governing our data ensure the processes around its management are worthy of that trust. The governance processes that go beyond the HSCIC control, will directly influence that trust, and our care.data decision to object, or not.
For citizens to see this still precarious commercial hull, and trust that our innermost confidences should be safe within it, is stretching our trust, just a little too far. The knowledge of our health and lifestyle should not be commercially exploited in this uncontrollable marketplace by data brokers without our knowledge and consent. Health data is on the cusp of including more widespread biomedical data. In my children’s lifetime that may be a whole new era of data management to contend with. For now, all this intensive data mining may be much more than we already imagined and we should carefully consider how society will be affected if it includes every aspect of our health and lifestyle data. It may be yet another aspect of individual surveillance more than society can stand.[18]
The care.data storm may not yet be over.
*****
In part three on commercial uses, I’m going to explore, from my lay perspective, on how some of these intermediaries and data processing companies, use data concretely in practice. As Julie Brill says how these intermediaries, “create a narrative about our past, present and even our future lives.”
[2] Food Marketing film by Catsnake with Actress Kate Miles via Upworthy http://www.upworthy.com/no-one-applauds-this-woman-because-theyre-too-creeped-out-at-themselves-to-put-their-hands-together
[7] 17th March Omega Solver in the Guardian, by Randeep Ramesh http://www.theguardian.com/technology/2014/mar/17/online-tool-identify-public-figures-medical-care
[8] 16th March Harvey Walsh in the Sunday Times by Jon Ungoed-Thomas ‘healthcare intelligence company, has paid for a database’ http://www.thesundaytimes.co.uk/sto/news/uk_news/Health/article1388324.ece
[14] Public vs Private interest – Dr. M Taylor, “Information Governance as a Force for Good? Lessons to be Learnt from Care.data”, (2014) 11:1 SCRIPTed
[17] Health Service Journal, June 12th, Nick Renaud-Komiya, http://www.hsj.co.uk/news/trusts-ordered-to-delete-incorrect-data/5071902.article?blocktitle=News&contentID=8805
[18] John Naughton, Observer 8th June, http://www.theguardian.com/technology/2014/jun/08/big-data-mined-real-winners-nsa-gchq-surveillance
Shakespeare who is long dead. Another, less famous, we celebrated at her funeral after only a few weeks of living with diagnosed endocrine cancer. She would have turned 76 this week.
The change curve
How do we deal with change?
Anyone familiar with the theory of grief, or more happily (as I am from my previous professional life) the similar theory for managing change, knows the stages along the curve we need to go through, to reach a new status quo after a process of adjustment.
After the initial shock and denial, there may be anger, frustration and fear before any acceptance or new optimism is possible.
Individuals follow the curve at their own pace. Some may not go through each stage. Others may simply be too upset, disagree early, give up with or repel the change, and never reach a comfortable position or commitment to a new status quo.
Whether it is grief or a business change, the natural initial response is emotional, and starts with loss. Loss of a person, of position, of something we cannot control. It can take a great deal of support, time and good communication to go through the journey.
(And yes, there’s a comms lesson for care.data in here.)
Before we begin on a change we need to understand the point from where we are starting. And crucially, to understand that Change is about people, not technology or business process.
The change curve starts with shock
From many people’s perspective, the concept of care.data, has been a shock.
For those working on the project, or at NHS England, that is probably hard to understand. ‘Why on earth all the fuss?’, they may ask. It’s easier to understand, if you realise the majority of the public had no idea at all, our health data was used for anything other than our direct care and some planning. Much less may have been winging its way on the cloud across the Atlantic. It feels like data theft.
It’s easy for those in a technology project to see ‘coded’ health records simply as data.
‘Coded’ is however like saying we speak the ‘French language’. Computers ‘only speak’ code, so telling the public it is coded is either trying naively to make it sound safer than as if ‘plain language’ was sent from the GP system to the central system, or it is misleading.
In the same way, if you say ‘opt out’ the system records ‘9Nu4’ on your record. In addition, there will be a label to go with it, so if GPs run a report to find everyone who has opted out, they can. It’s not hard to understand that MOTDOB is mother’s date of birth. There is a full public dictionary of these codes.
NHS England and the project team, should also not forget that this is not just ‘data’.
To us, this is our irrevocable health and social imprint. Signposts to who we are, have been and perhaps, will be.
It’s personal and private. And as yet, we may have only shared those facts with our GP. Only our GP and not yet our partners, or parents. And then we find out global Health Intelligence companies might have our sexuality or pregnancy history, conditions we may not have told anyone but the GP. Data intermediaries may have complete picture of prescribed medicines, drawing on information from 100,000 suppliers, and on insights from billions of annual healthcare transactions. “mountains of data from pharmacies, insurance claims, medical records, partners and other sources, 17 petabytes of data spread across 5,000 databases.” We want data used by the right people for the right reasons, and know where it goes and why.
HSCIC is giving it away almost for free.
To them it may be only data. To us it’s intimate.
But for the three of us in this marriage, it’s information which has been used and shared with these third parties, and as far as we can see, only one of us really benefits from the deal. Identifiable or not, is only part of the story. It’s our biography we did not give you permission to read or tell.
The initial shock, fears, anxiety and general disgust that our personal details are sold (sorry) given away on a cost recovery basis charging to cover processing and delivering the service, should therefore be more understandable if you realise it was a complete surprise.
(The surprise may or may not be quite as great as the exploding whale posted via Wired at the end of this post. Go on, you know you want to.)
Change is the only constant. How can we progress?
The Change Curve based on the Kübler-Ross Grief model
So, what happens now? How can the public move forward, to get to a position of trust and acceptance, that this is what is already happening with our hospital data (HES), and planned to happen with the majority of our GP stored data in future (whether we like the idea or not)?
In order to move us along the curve, NHS England have a large task ahead. In fact, a series of tasks ahead, which are not going to happen overnight. How are change and communications working together?
As there’s no detailed ‘care.data progress’ public communications easy to see on the top level of NHS websites I can only see other info as it comes out through online search alerts. And since it’s my, my children’s and all of us as citizens, whose data that is being discussed here, I think we should be interested and want to find out and question the ongoing status. The GP FAQs have gone or are hard to find, and the patient FAQs are still inaccurate IMO. This page should be top level leading, not six unsearchable clicks down.
From the latest update in the care.data advisory group meeting notes, with much more concrete progress to see, it is good to see that communications features often, and note ‘a comprehensive engagement plan is already underway.’
That plan will be interesting to see mapped out as time goes on, but I do wonder whether it is the right time to be looking at engagement, when so much for the care.data programme remains to be clarified or is undecided?
Questions remain how less raw data can be given away, further legislation, the ‘one strike and out’ how to deal with data breaches, views on enabling small and medium enterprises (SMEs) data access, GP staff opt out understanding, public op out understanding, clarifying the narrative of risks and safeguards. Some steps to be reviewed not until ‘over the summer’. And that’s only a summary of a summary, I am sure only a glimpse of the foam on the top of the wave of what is being done under the surface.
An engagement plan can’t have gaps. Communications is not one-way, that’s PR. So we can only hope there is a real engagement underway of listening which will result in action, but not in ‘transmit mode’. Engagement needs to be concrete to work from day one. We don’t need a sticky plaster and pat on the head, we need fixes and facts to back them up.
Communications and Change
Why can comms not start now and be added to as we go along, you may ask? Whilst it can, and indeed most communications plans need some flexibility, a good Communications Plan needs to ride leashed tightly to the Change Management Plan. And given that different individuals are each somewhere different on the change curve, at any given point in time, you need to be able to address questions that any of them may have, simultaneously, regardless of whether they have just heard the news, or are almost finished their change journey. For GPs, their staff, other medical professionals, citizens and patients.
Riding the wave of the change curve, some are nearly back on the beach, when others haven’t yet entered the water. Some have got out and will not be persuaded back. Others may.
Therefore until many of the open issues are resolved, until governance and legislation is clear, unless it is focused on listening and resulting action, most communications can only be wasted PR rhetoric. Perhaps there are great plans. But Houston, we don’t have a communications problem. Honestly. As far as I can see.
There is no communications issue, there are issues which need communication.
Why? Because folks who opted out already will not be sold on the benefits. They will only be convinced by a clear picture of known and well governed, legislated, mitigated risks AND benefits. Then they can weigh up a decision. (Assuming indeed, the Secretary of State is a man of his word and maintains the patients’ right to object, which is not a legislative right.)
“The law is a statutory enactment which requires the disclosure of the data, which means the data becomes exempt from the main parts of the DPA.” (ICO)
The trickiest part in the communications, is to address different segments of the population who are at different points in the curve, at the same time. Some of whom are hard to reach.
I am sure there are many people working behind the scenes to bring about this managed change. Let’s not forget, this programme was intended first to launch a year ago. Professionals are working on this, it’s not new. But Dear God, please don’t launch more communications along the same lines as before. September saw GP materials go out with no training and no measure of how well practices had understood the materials. A misleading poster and misdelivered leaflet for patients created more confusion. Which all went out before proper governance, legislation and technical solutions were in place to make it all work well. The advisory group minutes and Mr.Kelsey’s letter indicate there is much work to be done in these areas still. Yet engagement activities are planned May-July.
To look at basics, I think these three things for starters, need resolved before you can talk about risk mediation:
1. a) Purposes of what data is taken and b) who accesses data: the care.data addendum which sought wider purposes and third party access by think-tanks and information intermediaries is still to resurface, after being returned by the GPES IAG in February for amendment. Which means final data users remain somewhat undefined. And we’re still pending the complete audit of past and current data recipients through the audit overseen by Sir Nick Partridge. [NB: since done in June < see post]
2. Amber is not Green – data protection: Why is potentially identifiable data and what really quite clearly, will be identifiable when so many companies sole purpose is to take a wide range of data sources and mash them together, given no data protection in law and no clear choice over its use in HES release?
It may for release from HSCIC be treated more carefully than green data only in so far as it is not publicly published on a website,and goes to committee review, but it may be provided to a wide range of commercial companies who then create information from it which they release.
The raw data’s nature can be sensitive to us and it’s certainly personal, so that we would expect it to be kept confidential, and yet it is shared and may be combined with recipient’s other data sets are at individual patient level? It feels like a great big whale in the room – it’s not green, we can’t protect it, but if we close our eyes it might go away.
It’s not conducive to trust, when it feels like a con. Just call me Ishmael.
3. Individual data control – opt out and rights: Point 2 leads to a huge potential iceberg ahead which still needs resolved. The UK and upcoming new EU protection laws and their, the ICO and the HSCIC definition of anonymous and pseudonymous data. We must understand how they are to apply and are not only legal, but feel just and fair to us as citizens. It should be looking ahead to meet the coming law now, shaping not avoiding best practices.
What rights does the individual have? How will GPs resolve their conflict of protecting patient confidentiality and complying with the new law requiring them to release it? Some GPs don’t think it’s a good idea.
There will be some citizens who want no data stored centrally at all and even want their HES back out. What will they say to someone who point blank does not want any of their medical record outside their practitioners’ control?
So, are we about to see a repeat of the same communications catastrophe – launching engagement, before we know what exactly what it is we’re talking about? Surely not. But looking at the calendar…
As an outsider, I just wonder how can effective engagement begin, when questions may be asked which cannot be answered?
Workshops to separate truth from myth, risk going down as well as Ahab in Melville’s story, if you have people who are upset, and you have nothing to offer them but unsupported ‘reassurance’. I’d like to see a webpage or presentation of those myths, because I don’t feel I’ve seen many myself. If anything, issues have been debunked by careful wording rather than straight talking.
Change and Trust
Change can’t be done to us without huge resistance. Change has to happen with us, if we are to trust and adopt it. If collectively we get stuck in anger and fear, we’ll not get to acceptance. And it actually has the potential, suggested Ben Goldacre, if not already done, to leave a negative wake on wider research & society.
There has to be trust in the change, that it is for widely acknowledged ‘right’ reasons.
There has to be trust that the terms of the change are defined and stable. Words such as currently, and initially, have little place in the definition of future agreements.
There has to be trust that what we will lose, is in proportion and outweighed by what we’ll gain from the new.
Until the history is entirely transparent, it is a challenge to see how concerns about past use and lack of past governance, and the lack of trust those errors created will be possible to fix. The sensitivity of our raw data is likely only to increase as scope is broadened in future, and the scale of the requests is expected to increase as the era of Health Intelligence takes off and becomes ever more profitable for those third parties.
Trust will need to increase if anything proportionately, as this scale and sensitivity increases. So any communications of future releases and their governance needs to be sustained. It’s not an afterthought of ‘what we’ve done’. It’s the key to being allowed to carry on doing it.
Change Managers need to understand an individual’s own story, values and what makes them tick, to have an expectation of what the change impact (possibly negative) will be for individuals or groups and what’s in it for them (the positive) and any wider impacts, for example considering the Public Interest. And all leaders, need to have available from the start, the information which will answer the questions for people in each of these groups, at every stage of the curve.
Decisions in the public interest, may be subjective. Jeremy Hunt has said that we,
‘will “get through” the heated public debate this scheme has caused regarding patient privacy and the potential for the data to be re-identified.”
I’d like to hope we get more than ‘through it.’
To say that, underestimates the task ahead.
It’s not a tunnel or a final destination, but a process.
And the longer the data is shared over our lifetimes, the more likely it will be re-identified with all the other passive and other Big Data which is shared in our future. So there’s no patch, pop up and coast to the beach. I can only think this is a one time chance, and the leadership comments seem to underestimate it.
It must be done correctly now, to set up a framework which will be robust enough for the future size and complexity of the future Big Data vision.
Legislation to build a solid Future foundation
There are still many unknowns it reads from the meetings, from opt out, to wide ranging governance issues, to securing watertight legislation. The scale and sensitivity of the data and how it has been handled in the past, shows how the current model is not fit for purpose.
This week there is still crucial legislation being considered which will help to fundamentally cement or fail public trust.
Trust not only in how our data will be governed, but in common sense in our governing bodies. The legislation addresses:
Retaining control and management of confidential information
Putting the independent Information Governance Oversight panel on a statutory footing
Independent oversight over certain directions and the accreditation scheme
etaining control and management of confidential information – See more at: http://www.allysonpollock.com/?p=1820#sthash.No8G7kcT.dpuf
retaining control and management of confidential information – See more at: http://www.allysonpollock.com/?p=1820#sthash.No8G7kcT.dpuf
I’m no legal beagle, but it appears to make excellent sense and the detailed wording (via Prof. Alison Pollock’s page) is very straightforward.
“the current law of data protection, with its opposed concepts of ‘privacy’ and ‘public interest’, does not do enough to recognise the dependencies or promote the synergies between these concepts.”
If the Lords support Life Sciences’ interests, as many in the chamber do, they will need to support the proposals in order to ensure the public remain opted in to care.data.
Without these governance amendments, many more will opt out I am certain from talking to people on the street, and the value of the population-wide database will be undermined. So, the theory on paper next week, will have a crucial role in the practical outcome of the care.data implementation and its lifetime value.
No one said, change is easy
Importantly, in any theory one does well to remember the practical reality. Each response is unique to an individual. No one model will fit all. Each person commences the journey of a changing situation, from a different starting point. We each begin the process from a different level of baseline knowledge. We each have our own ways of dealing with loss, and experience different levels of anger or fear. There are early and late adopters.
Some things are difficult, but have to be gone through. For me, Tuesday was a day of looking back at wonderful memories.
We also sometimes need to accept what cannot be changed. When the time comes, I support the idea that we can live with a disease and dignity, not just the label that we are ‘dying’.
My final inspiration of the week, Kate Granger articulated this, so much better than I could, last week:
“I cannot imagine a human society free from cancer, no matter how much money we invest. As a cancer patient who will die in the relatively near future, I believe rather that instead of reaching for the traditional battle language, [life] is about living as well as possible, coping, acceptance, gentle positivity, setting short-term, achievable goals, and drawing on support from those closest to you.”
care.data requires courage from all the parties involved, because everyone is going through a certain process of change and compromise. Even those who planned the now delayed launch, need to recognise a need for change and why we’ve got to put a solid, not rushed foundation in now, and be in it for the long haul to get it right.
With lasting legislative powers, we public can better entrust our faith and data to the system, not just today, but into the future. With a proper independent Governance and oversight process we can hand you our trust for safekeeping with our records in good faith. We can only trust these proposed changes make not just waves, but make real progress.
If nothing really substantial changes in the pause, and we don’t see increased measures to create trust, all that will happen is a build up of frustration and pressure of all the people who can’t move forward from the initial anger and confusion. They will opt out. And there’s a risk public opinion will burst under pressure. No one will want to support health record sharing for any purposes, even bona fide good research, and there will be an explosion of opt outs. Projects will be abandoned, like a dead, washed up whale. (Which you really don’t want to happen. Really. It’s not pretty viewing, don’t say I didn’t warn you. But it’s kind of fascinating too and all the number crunching too.)
This can be avoided.
But plus ça change, plus c’est la même chose. Two months into the pause, are we seeing changes taking effect, or more of the same talk?
I look forward to better information on how and where our data has gone in the past. I think only after that will it be possible to get the history aired and resolved for improved future procedures once we have the complete audit picture, including that under Sir Nicholas Partridge, due towards the end of this month.
The further governance and independent oversight issues will be best resolved in legislation, which would help them be free of political change and create a framework worthy of the big data vision for the future.
In Summary
I hope the Change Management is as carefully thought out as communications and engagement is based on substantive steps before it.
These steps simply, start with:
1. a) Tighten and define clearly the purposes of what data is taken and b) who accesses data. Now and for future change.
2. Amber is not Green – data protection: Tighten what is potentially identifiable data and what really quite clearly, will be identifiable when so many companies sole purpose is to take a wide range of data sources and mash them together.
3. Individual data control – opt out, and legal rights. Will opt out get a statutory footing rather than Mr.Hunt’s word? Will we design now, for change in the UK and upcoming new EU protection laws?
Tighten the processes, define more of the facts, so you know what you’re communicating. Let people ask questions, and let us have sufficient time to go through the curve.
A rushed rollout, will create more people who block the change, opt out, and never return.
I realise much of this post addresses how I feel, and the feelings I have picked up from care.data events, from others discussing it on the street and school playground. Emotions have a role to play in this discussion, but better facts will go a long way to making objective informed decisions. And crucially, our decision making must be allowed to be objective and free from emotional coercion.
I’m cautiously optimistic and look forward to seeing public materials to get the GP profession and public on board and riding the care.data change curve each at their own pace. There is clearly a tonne of work to be done. It’s not going to be glassy, by any stretch of the imagination, but perhaps we need a few rough times to remind us what matters most to us, and why.
It makes us engage.
The question is, in the coming weeks and months, is NHS England prepared for genuine change and engagement with the public, not just PR?
“Will it become a productive process putting patients’ choice and empowerment first, or is it all talk, hurling stones at one another, going round in circles and building nothing?”
Since The Lords voted to reject proposed amendments last week, to legislation which would have emphasised patient empowerment in the programme and shored up trust, I feel a little in limbo.
As patients of the NHS in recent times, we have been bombarded with the language of patient choice, personalised care and patient empowerment. Putting patients first.
But what power or choice do we patients really have in the use of our health data?
It seems that increasingly media articles, meeting minutes and speeches talk of power and patient empowerment, but it feels like in reality we have less and less.
So too we hear repeated how ‘powerful’ our health data is. How the power of data and its management is used, how the concomitant language is used, misused and shared with others, influences decision making around the subject and our patient rights.
All things are subject to interpretation. Whichever interpretation prevails at a given time is a function of power and not of truth. – Friedrich Nietzsche
As a Germanist at university, interpreting Nietzsche was both a cause for celebration and a cause of much gnashing of teeth. Having also studied Italian, I’m mixing my Dante in there, apologies.
The gnashing of teeth, biblical in origin, was reserved by Dante for the fourth circle of Hell, in his most famous work of his trilogy, the Divine Comedy. The fourth circle was the realm of money. It contained two opposite groups, the avaricious and the squanderers. The bridge builders and the destroyers.
Both the hoarders and the wasters are obsessed with development, either promoting it, or stopping it at all costs. And their punishment is to go round in circles, labouring against each other with heavy rocks, from opposing sides for eternity.
My background is in making technology functional for users to make their work easier. Systems only work which have a proven benefit for the stakeholders. Introducing new systems is not about technology, but about people. If people don’t want to use your system, you can’t make them. They will find a workaround or data quality will be so poor as to make it worthless. Any project with opposing sides, will have some degree of argument and failure for one or more parties. It’s not what working together, should be about.
When I heard the Lords debate, two things struck me.
The first, whilst different arguments were debated they were really not opposed to one another, but trying to find the best way of achieving the project aims. The vast majority were common sensed and aligned. Wellcome and the AMRC support the legislative shoring up of trust. The biggest difference was that citizens’ trust and empowerment were supported better by the amendments, yet the vote went the other way.
The second thing which struck me, was how the language used can sway what we believe. We only believe what we want to believe, after all.
Labelling data as anonymous or de-identified when what is meant is pseudonymous, and mixing in ‘Open Data’ when ‘shared data’, is meant, is not the same thing at all. And it’s very misleading.
“I stress this point in particular, as I understand that it has been the subject of some confusion. There is already a strong legal framework protecting the confidential and identifiable data held in people’s health and care records, not just the information held by the HSCIC but more generally. The Data Protection Act, which implements the EU data protection directive into UK law, provides powerful protection of information about living individuals. To summarise what is a lengthy and complex provision, it requires all such data to be anonymised except where there is good reason to the contrary. It remains the case that the Data Protection Act continues to offer strong protection of personal data…”
The fact he wants to make such efforts to ‘stress this point in particular’ does not fill me with faith in the system. In fact, I’ll be honest, I feel that on this point he was factually misleading.
Firstly, in terms of extraction.
The default position is to extract fully identifiable and personal data unless individuals object. PCD will leave the practice for all patients, where there is a legal basis i.e. under the HSCA 2012 or Section 251 approval.
So for Earl Howe to focus on anonymous use, detracts from the fact that it is not anonymous upon extraction at all and may be used and is used with identifiers, far more widely than patients might expect once processed. And will be by default, unless people activley opt out.
Misuse and inappropriate levels of risk exposure are made less transparent by the wording of what type of data it is.
Time and time again, even in the Lords last week, I am frustrated to hear inappropriate use of terminology which perpetuates misunderstanding.
We need to be very clear what differences there are between data sharing and Open Data. Professor Sir Nigel Shadbolt addressed these differences and the release of Open Data at this conference on March 20th 2014. He importantly makes the distinction that the reusable open-to-use-by-anyone data of Open Data definition, is separate from most uses of personal data, even in the current ‘grab’ going on. [his words]
The Open Data movement is not trying to liberate and put out all our personal data. He sees personal data, fully and properly anonymised, with consent, will play a role. But we need to understand different ways of handling the different types of data.
Governmental legal guidance in 2010 did not have the interpretation we have been given today of amber, pseudonymous data. In this file you’ll see it’s personal (red) or it’s not (therefore fully anonymous). But it is clearly noted that anything which is not fully anonymous, i.e. what may identify individuals (what HSCIC labels Amber), should be treated no differently from red data.
“If the data to be shared is fully anonymised, then it will be less likely for problems should arise, though consideration still has to be given to the principles in the Data Protection Act 1998 (DPA). If the data required for statistical purposes contains information which may identify individuals (personal data), then the sharing should be approached in the same way as for any other circumstances, as explained in this guidance.”
I have no idea by whom and for whom it was written, but they state they consulted ICO.
We need to be clear, this is important both for public and parliamentary perception to make informed choices and inform the parliamentary care.data and wider data sharing debate.
In Parliament yesterday, Chi Onwurah MP (14 May 2014 : Column 848) said with regard to the Apprenticeships, Skills, Children and Learning Act 2009 – my bold:
It is therefore deeply troubling that the Government have tabled a last-minute new clause to the Bill to authorise data sharing among the Department for Business, Innovation and Skills, Her Majesty’s Revenue and Customs and persons providing services to them when it comes to apprenticeships. This may be both necessary and useful—the actual data to be shared may be entirely harmless—but it should be done transparently, with the right safeguards and accountability in place, and it should be done as part of a coherent strategy. This is clearly not the case here. The “person providing services” could be anyone, from individual consultants to big multinational companies.
We therefore tabled amendment (a) to ask what information was being shared, with whom, by what process, with what accountability, and how it fitted into the Government’s data sharing strategy. If the Minister can answer all those questions, perhaps the amendment will prove superfluous. If not, why not?
Doesn’t it sound rather familiar? Rushed amendment, lack of transparency, loose terminology of data recipients and purposes. If data is presented in wording which is inaccurate, we can only expect its use to be so too.
We need to ask what is the Government’s data sharing strategy and whom does this legislation serve?
Increasingly it seems to me that the Government is firefighting ad hoc bits of data legislation into existing Bills to enable their initiatives which need our personal data. We are being mined on all fronts. Open Data across the board, HMRC plans, DWP, the NPD, DVLA, care.data and more. And mostly, without our consent and often without our informed knowledge.
How is this empowering patients and citizens by removing our choice or rights of autonomy?
Some data sharing programmes may have been addressed and work well. But it takes more than a bathful of corks, to make a watertight boat. It sounds to an outsider, like overall data sharing design and strategy needs to go back to the drawing board and draw up a decent infrastructure. Patching like this, is a waste of time IMO and we can just sit back, and await the future leaks. I just hope they won’t be nightmare stories in health.
All in all, ‘you have a choice’ sounds rather hollow in all manner of fields right now. It’s been a bad week for patient power from where I write. Our local GP practice caring for 4,000 patients is set to close at the end of the month and the list shared out to three already full alternative practices.
“making data available to the public does drive choice in the same way it would in consumer markets such as financial services or mobile telephones or whatever.”
Freed data was seen to walk hand-in-hand with choice. We were told with patient choice, would come patient empowerment. The NHS was turned into a consumer market in the HSC Act 2012.
It’s therefore ironic that the foundations of care.data fail to put patient choice as its cornerstone. It’s not a consent process which is set out by the HSCA 2012 (250-60’ish). It’s a gateway for extraction with no more than fair processing requirement. That loss of autonomy is not giving patients control nor choice. And the choice that is on offer, is limited. Both in scope and time. The only choice offered in the patient leaflet and communications, is to restrict fully identifiable onward data sharing from GPs or from HSCIC. And to be excluded from care.data is a limited offer – before it is launched. After that, the only choice left is to request the data which has been extracted is made pseudonymous, but it is not possible to remove it.
There can be no arguing with what has happened in the past regarding data releases which may no longer be seen as wise. Despite the fact the Information Centre cannot tell us today, (Q272) who all the end users of data have been in the past, we are offered no new barriers to breaches of trust happening again.
The Health and Social Care Act 2012 brought in fundamental changes in both practice and balance of power between patient and provider, and the State. These are changes in society over which we have little control, for now. Come the next General Election, there may be political change and ideology may be different. It may not be. And inevitably in our current political system, it will swing between different thinkings over time. But our health records given up today, are given up for life. Commercial exploitation is a value set being thrust upon us, which we may or may not not embrace. Both in terms of with whom our data is shared, who is managing it and how.
I met my own MP last week, thanked him for sharing my concerns with the Department of Health last October, and discussed the current status of the programme. He asked me, was I against sharing our medical records at all costs? To which my answer was no. No with a number of caveats.
We are used to, what most would see in this country, as a benign government. Events around the world, show us that we should not take it for granted. (I imagine at this point a failed Conservative election 2015, Boris with his cornflake model for society, replaces Cameron at some point in the next term, and wins in 2018 with support of a minority UKIP coalition. My personal result from hell. Don’t forget to vote May 22nd!)
If we have no statutory strength, what do patients really have power over in the choice to share our medical records?
So far we have only an objection to identifiable data sharing. No opt out of other data sharing from HES at all has been offered in patient communications. No opt out form and nothing in law. And Mr.Hunt’s word of ‘an objection which will be respected’ but does not yet match with what he promised on February 25th, and opt out of anonymised data used in research.
…”we said that if we are going to use anonymised data for the benefit of scientific discovery in the NHS, people should have the right to opt out”
That’s not only on identifiable data as the patient leaflet proposed. However I fear this may once again become subject to interpretation. Mr.Hunt has the power to make his promise a reality. I would greatly respect what he says, if we see his words become action.
“no one who uses a public service should be allowed to opt out of sharing their records. Nor can people rely on their record being anonymised..”
So who holds the power to make the decision? Mr.Hunt, Mr.Kelsey or do they mean what they say, they want empowered patients?
Whilst there are individuals who appear obsessed with pushing forward the promotion of health data sharing, at all costs, whether with their own Life Science company background interests, or with a vision of how we will mash it up with supermarket loyalty cards, others may be pushing back, immovably opposed to the whole idea of removal of GP patient confidentiality.
Unlike the fourth circle of Hell, there appears to be a more commonly held middle ground.
However, reality is that the opt out does not work like that yet. So far, we do not have a communicated choice on amber HES.
So even for those who support some data sharing, whilst trust hangs in the balance, people will not support a system which appears to deliberately disempower us. By first starting with opt out, care.data is skewed to removing patient choice from those who are not paying attention to public issues and we’re not sure of the security of the objection on offer anyway. Those who are alert, mainly dislike the idea of our data being traded with third parties who may use the data to create knowledge which they sell on, for profit. When we see stories of who uses it and how, we feel let down.
It feels both an abuse of trust and of power, that having trusted ‘the system’, we have been failed by its gatekeepers and guardians.
It is ironic that in a society in which news and campaigns persistently remind our children that their bodies are their own, that the knowledge of their workings will be taken from them without their knowledge or future ability to withdraw their consent and remove their records. In their lifetime, it might not only be e-data but biomedical.
Within assumed consent and opt out based on an honour system, is the question of power and control. There is one person making a decision who can choose whether or not to respect our objection.
We have only his word, that we have an objection to share any individual identifying data from our GP practice.
The patient leaflet says, ‘you have a choice.’
In reaching our choice, I also ask if we are each individually empowered to make it of our own free will, or will we be emotionally ‘encouraged’ to see it as the right thing to do?
Perhaps made to feel selfish if we do not. Is this free and informed, and not coercion?
Citizens must be pro-active to opt out. The last letter from May 2nd online from Mr.Kelsey suggested we can work together, to get care.data right. However, in the same letter our patient choice, comes at a price. Whilst being encouraged to see reasons to stay opted in and give up our data, we are told of a patient who was misdiagnosed and died.
“In future, this can help prevent cases such as Alison, from Hampshire, who went to her GP suspecting she had a brain tumour, but was prescribed painkillers. She was eventually diagnosed in A&E after a seizure and died less than a year later.”
I feel when I read that, it came across very much as, “see what happens if you don’t share your data? You’ll die prematurely” and the second statement on cancer in A&E made us feel guilt that we may not help us identify why someone else who died. And if fear and guilt are not strong enough sticks, here’s the carrot, by sharing our data we’ll keep it safer somehow, by entrusting it to the State:
“minimise the risk to a person’s privacy being compromised in an age of increasingly sophisticated digital threats.”
(Erm, let me keep it only accessible by my GP practice then, rather than risk sharing it via Google Cloud?)
Please. Stop chivvying us into doing what you want. We have a choice. The leaflet, which we may or may not have ever received, told us so on the front cover. You cannot also tell us what to choose. Big Brother, you don’t have the right to make up our mind for us. No matter your own experiences, whether it’s a family friend’s care, or the terminal illness of a son, or indeed each of our own family experiences. None of us have the right to decide what is a correct decision for others. Neither should Mr. Hunt be asking GPs to ‘sell’ the programme to patients. It’s an abuse of power to coerce a free choice.
I don’t want to feel emotionally manipulated. Just be straight talking and trust us to make up our mind as we see fit.
Overly aggressive charity collector chuggers asking for cash donations on the street, get short shrift these days. It feels like the programme is still trying the same, with mildly threatening tactics in order to use our data, by research charities among others. The lesson why that’s not right seems not to have been learned. The Wellcome Trust clearly does understand what is needed and backed the Lord Howe’s governance and oversight proposal. (Col 1520).
The letter also gave the impression that poor or missed diagnoses in primary care were responsible for disproportionately finding cancer in A&E, which was disputed on social media Twitter by medics suggesting similar use of statistics had been previously corrected, when NHS England retracted it last autumn. Another lesson not learned. Is it an abuse of statistical data if whilst factual, it is knowingly being misunderstood and creating misinformation. One could also ask, is this not an abuse of the power of data and anecdote?
Dante was a tad cheeky in the Comedy. He sought to create his own immortality. By retelling the stories of the damned, he created his own power over them. He controls the narrative, selecting whose stories get shared and those which do not. He is selective with the truth. He believes that by interpreting others’ stories he could give them, and himself, an eternal life. He puts himself among the great poets who have gone before him and enjoys their glory.
He is led through Hell, by Virgil, someone he both adulates and trusts.
So too patients need leadership we can trust and respect. We need transparent and accurate truth, if we are to build trust. There is no room for emotional blackmail.
There should be no power struggle in a free decision. Like in the Divine Comedy, there’s lots of rights and wrongs, differing ethics and moral dilemmas to consider. But judgement should not be made.
Personally I believe it is not right that we parents should determine now what should be our children’s choice, with no correction nor future opt out. Not everyone *is* a willing research patient, and that’s OK. Others may want to be as involved as possible. Only 4% of the population are blood donors, but I’m not going to browbeat anyone into doing it who isn’t.
A stick is still a stick, even if you tell us in your opinion, it’s the right thing to do. You want to empower patients? Prove it. Empower us with statutory opt out and trust us to make our own choice.
Put patients first and show us you mean it.
Will it become a productive process putting patients’ choice and empowerment first, or is it all talk, hurling stones at one another, going round in circles and building nothing?
Does Mr. Hunt, Government and NHS England really want to involve patients about decisions made in the NHS, and in the use of our health data in particular?
What powers-at-be are deciding how our data is managed and governed and who can have it and why?
One of my favourite mottos is found in ‘Inferno’, Dante’s Hell.
“The hottest places in hell are reserved for those who, in a time of moral crisis, maintain their neutrality.”
In Dante’s Commedia, treachery against religion and against government are both reserved for Hell’s final circle.
I hope my public stance is helpful. I fear it has become a bit of a rant. Apathy is neutral. But this is no time for neutrality. There are those in power who make decisions, those with power who influence them and the rest of us. We need to speak up.
To protect our patient choice and to ask to exercise our patient power, so oft championed in word by NHS England and Government, feels so far, rather a risky position to take and challenge what is yet an empty promise. But public opinion should not be ignored when considering what is deemed to be in the Public Interest. We need a more interested public to understand what it will mean if our health data is given freely to third parties, perhaps cross borders, in pseudonymous form without data protection controls or any need to respect consent or inform us. Not just today, but for our lifetime and beyond.
We need some good interpretation and good bridge builders.
We need leaders we can trust to lead us through this process and positively out the other side.
..”every single NHS patient should have a right to opt out of having their data used in anonymised scientific research. I think that was the right thing to do. Of course we are having a difficult debate, but its purpose is to carry the public with us so that we can go on to make important scientific discoveries.”
Power to the People, was timely this week. Is it all talk, or do you trust us to make our own choices? Trust is a two-way process. You want us to trust the system? Give us a statutory opt out. Get the governance and oversight procedures sorted out. Narrow the commercial purposes for which data can be used.
I think patients can see the benefits of the programme, but it’s going to be hell getting to a workable solution if basic patient empowerment is left off the discussion table. After all, it’s our data.
To be or not to be, that is the question.
O, what men dare do!
Two gentleman of Verona
Measure for measure
and in a Midsummer’s Night’s Dream
And like the baseless fabric of this vision
imagined there would be much ado about nothing.
Mum’s the word!
But this denoted a foregone conclusion.
Open-eyed conspiracy!
Wherefore are these things hid?
Oft expectation fails, and most oft there
Where most it promises.
The plan would be a winter’s tale.
But as you like it
or as not
Damn’d be him that first cries, ‘hold enough’!
These tedious old fools!
The tempest doth make delay.
Will the work done be love’s labour lost?
Will the storm nay be calmed?
Sigh no more, ladies, sigh no more,
Men were deceivers ever.
Would they want that chinks be earned
Gold? Yellow, glittering, precious gold?
No, Gods, I am no idle votarist!
All gold and silver rather turn to dirt!
As ’tis no better reckon’d, but of those
who have want.
“Shylock, we would have moneys,” you say so
the pound of flesh which I demand of him
is dearly bought. ‘Tis mine.
What might be toward, that this sweaty haste
Doth make the night joint-laborer with the day:
Who is’t that can inform me?
Friends, Romans, countrymen, lend me your ears!
Who bare my letter, then, to Romeo?
The letter was not nice but full of charge,
Of dear import, and the neglecting it
May do much danger!
Ignorance is the curse of God;
knowledge is the wing wherewith we fly to heaven.
No legacy is so rich as honesty.
For all this same, I’ll hide me hereabout.
His looks I fear, and his intents I doubt.
And exempt from public haunt,
finds tongues in trees.
You are thought here to the most senseless and fit man for the job.
Alas poor Yorrick
a fellow of infinite jest, of most excellent fancy.
Conscience doth make cowards of us all.
And enterprises of great pitch and moment
With this regard their currents turn awry,
And lose the name of action.
What’s more to do,
Which would be planted newly with the time,
How poor are they that have not patience!
Yet, do thy worst, old Time: despite thy wrong.
Don’t trust the person who has broken faith once?
The quality of mercy is not strain’d
I have spoke thus much
To mitigate the justice of thy plea
If we should fail –
We fail!
But screw your courage to the sticking-place,
And we’ll not fail.
All’s well if all ends well.
Love all, trust a few, do wrong to none.
Now this overdone or come tardy off,
though it make the unskillful laugh,
cannot but make the judicious grieve,
the censure of the which one must in your allowance
o’erweigh a whole theatre of others.
What’s done can’t be undone.
Forget, forgive, conclude, and be agreed: Our doctors say this is no time to bleed.
***** Words taken in tribute, from the works of Shakespeare
(23 April 1564 – 23 April 1616). All his words, not necessarily in the right order. Celebrated on the date of the 450th anniversary of his birth, on Metro considered, what if Shakespeare had Twitter?
![care.data should be like playing Chopin – or will it be all the right notes, but in the wrong order? [Part one]](https://jenpersson.com/wp-content/uploads/2014/07/chopin-664x372.jpg)
