Around 20 Million People Unaware of Plan to Share GP Medical Records with NHS Database, Which? Finds

Almost half (45%) of adults in England, around 20 million people, are unaware of plans for medical records about them held by their local doctor to be shared with an NHS database, Which? research has found.

The consumer champion’s survey shows why the government was right to announce recently that it is delaying implementation of the General Practice Data for Planning and Research (GPDPR) programme, launched in May this year, and why Which? believes there needs to be better communication and transparency from NHS Digital and the government moving forward.

There may be benefits to effective sharing of health record data, and the government has said the data will only be available to third parties for health and care purposes and that identifying personal information, such as date of birth, will be replaced with unique codes. But the benefits of this specific scheme do not seem to have been communicated effectively so far.

It is clear from Which?’s survey of nearly 1700 adults in England that there is low awareness of these data sharing plans, and concern from people that they do not have sufficient information to make a choice. This has then bred suspicion among some people that data could be misused in the hands of commercial organisations.

Of those who had been unaware of the plans, four in 10 (39%) said they would now likely want to opt out after being told about them in the survey.

Which? found that of just over half (55%) who had heard of the scheme, seven in 10 (71%) felt the NHS had not publicised it well.

Half of the respondents in Which?’s survey who had heard about the NHS plan said that this had been via the news or social media, not from the information put out by NHS Digital on its website and in GP surgeries – which many of us have not visited in person due to Covid restrictions. This raises concerns about the accuracy of information people were seeing, as NHS Digital had not publicised it widely in the news or online.

A lack of transparency around the scheme has the potential to impact people’s trust in the NHS. At the start of the survey three quarters of respondents (75%) said they trust the NHS to handle their GP medical records safely and transparently. However, four in 10 (42%) said hearing about the scheme in the survey had made them trust the NHS less.

Four in 10 (38%) of the people that took part in Which?’s survey said they were not happy that the NHS wants to share data from their GP medical records under this new scheme.

Of the group who had heard of the scheme and had opted out, a third (32%) of them said that they had found the opt-out process difficult.

A number of people who opted out of the scheme said it was because they did not want their data to be sold to private companies – even though NHS Digital has said that the data it collects will not be shared with marketing or insurance companies. The data will not leave the NHS – although third parties, some of which are commercial, will be able to access it. The NHS Digital webpage for the GPDPR says it has a strict and well-established process for providing access to data for external organisations.

A separate recent Which? survey about health and wellbeing apps found that about half of people (53%) would be comfortable sharing their health data with public health bodies, but only a third (31%) feel the same about it going to private companies that are developing health products and services.

The GPDPR would see GP surgeries in England automatically upload and share the medical records of every patient in England to an NHS Digital platform, unless the person has opted out. These records include details of people’s physical, mental and sexual health, as well as wide-ranging data including appointments, test results and medications from over the past 10 years, and information about sex, ethnicity and sexual orientation. It does not include names, written medical notes, and certain data that GPs are not permitted to share by law, including information about IVF treatment and gender reassignment surgery.

It is worth noting that medical data can already be used to further scientific research without this scheme, under the General Data Protection Regulation (GDPR). It can be shared, for example, when required by law, when consent is given to participate in clinical trials or when there is an overriding public interest.

NHS Digital says data will be pseudonymised which means details that could directly identify people such as post code and date of birth will be replaced with unique codes before they leave the GP’s surgery. However the NHS notes that it will be able to use the software to decode the data in certain circumstances, and where there is a valid legal reason such as participating in a clinical trial. It will not collect patients’ names or full addresses.

NHS Digital has said GPDPR will see information shared with, among others, research organisations, including universities, charities, clinical research organisations that run clinical trials and pharmaceutical companies – but Which? feels this list could be open to interpretation and more clarity is needed on exactly who can access the data. NHS Digital told Which? that it is hard to narrow down the list as it is primarily interested in the reason given for accessing the data, rather than the type of organisation that makes the request.

NHS Digital recently announced that it will delay collecting data under the new scheme until public awareness of the programme has been increased and privacy safeguards have been met – the deadline had previously been 1st July and then delayed to 1st September after pushback from medical professionals, MPs and interested groups.

Which? supports this further delay and believes that providing full transparency and better communication about the scheme will enable people to understand exactly how their data will be used, so they can make a clear and informed choice for themselves.

Rocio Concha, Which? Director of Policy and Advocacy, said:

“The coronavirus crisis has thrown into sharp relief the opportunity for health data to be used in ways that benefit patients and society in general  – however it’s really important to engage the public effectively on how their data is going to be used and the governance of data sharing with third parties.

“NHS Digital and the government are right to delay implementation of the GPDPR scheme and must now go to greater lengths to engage the public, raise awareness of the scheme, and increase people’s understanding of it through better communication and transparency.”