Patients Can Opt Out of their Medical Information Being Shared
There is an element of truth in that patient data can be shared without permission BUT patients have the right to refuse consent for the processing of their data. Let me explain the SUS (secondary uses service) and HES (hospital episode statistics) databases are the responsibility of the NHS Information Centre. Further information about these services are available via http://www.ic.nhs.uk/sus. This is for England and Wales.
There is something called a Section 251 which basically is a way for identifiable patient data to be processed without patient consent often when they can argue that it would be too difficult to get everyone’s consent they can apply for a 251 agreement. But even when a Section 251 agreement is in place a patient can still refuse permission for his/her data to be processed and this must be upheld. A section 251 agreement does not override a patient’s refusal of consent. The difficulty is knowing that your data is about to be or has been shared without your knowledge if you do know then you can make sure that you always refuse consent for your data to be used for anything other than your direct care.
In brief SUS processes lots of patient data for a range of services not directly related to patient care. So perhaps for your GP can get paid for a particular service or for research to improve public health. HES collects data about all outpatient and inpatient episodes so if you ever attend an outpatient appointment or have a stay in hospital then your data is held on the HES database.
The important things they (usually) don’t mention: they often don’t tell you that they are going to share your data or if they do they do they hide it in small print in a leaflet that nobody reads so technically they have informed you but the reality is that you are not aware of it. Patients CAN opt out of this and refuse to have their data shared for purposes other than their direct care if they want to it raises a lot of eyebrows but you can do it. The NHS tells patients that their data is shared anonymously but this is not true. They share for example, your date of birth, your postcode, NHS number, GP code, consultant code as well as details about diagnosis and so on need I go on? This data is also shared for research purposes and although again they say it is anonymous it is not (as above).
When the new GPES (General Practitioner Extractions System) comes in in April it will be even more important for patients to make their GP aware and have their records flagged as not consenting if they don’t want their data shared. GPs are supposed to inform patients about GPES and the sharing of data but I am not convinced that this will be done adequately.
Another minefield of issues where patients need to be aware of their rights.