GP practices across England will soon be required to supply patients’ personal and confidential medical records, on a regular and continuous basis, to the Health and Social Care Information Centre (HSCIC).
The data upload is due to commence in March 2014 and all households should receive a leaflet (‘Better information means better care’) through their letterbox about this in January.
Details from your medical record will be extracted from the practice in a form that can identify you, and will include your NHS number, date of birth, postcode, gender and ethnicity, together with your medical diagnoses (including cancer and mental health), their complications, referrals to specialists, your prescriptions, your family history, details of your vaccinations and screening tests, your blood test results, your body mass index, and your smoking/alcohol habits.
This programme is called care.data, and the information uploaded will be used for purposes other than your direct medical care (so-called “secondary uses”).
Medical staff treating you in GP surgeries, hospitals, A&E and out-of-hours centres will not use, or be able to use, this database. However, the uploaded data is likely to be made available to organisations outside of the NHS, such as universities and commercial organisations.
Under the Health and Social Care Act 2012, GP practices have no choice but to allow the HSCIC to extract this information.
Once the data has been extracted, the GP practice is no longer the data controller for that information, and cannot control or protect in any way how that information is used, shared or who has access to it.
Although GP practices cannot object to this information leaving the practice, individual patients and their families can instruct their practice to prohibit the transfer of their data, i.e. you have the right to opt-out.
If you do nothing, i.e. you do not opt out, then your medical information will be extracted and uploaded to the HSCIC.
Once uploaded, you will not be able to get this data deleted by the HSCIC. So if you want to opt out, you need to act now.
To opt out, simply fill in your details on the form to the right of this page, cut it out and post it or drop it in to your GP practice, marked for the attention of your GP. If you wish to opt out your children or other members of your family for whom you are responsible, you can add their details on the back of the form.
This is not the Summary Care Record. The two databases are very different. Opting out of one database does not mean that you have automatically opted out of the other.
For further information see: ‘Doctors raise fears over sharing NHS patient medical records, The Independent 19/2/14’.
Copy the following and drop it in to your doctor if you want to opt out. If you are not sure what to do, the advice is to opt out.
Dear Doctor,
I am writing to give notice that I refuse consent for my identifiable information and the identifiable information of those for whom I am responsible [delete as appropriate] to be transferred from your practice systems for any purpose other than our medical care.
Please take whatever steps necessary to ensure my confidential personal information is not uploaded and record my dissent by whatever means possible.
This includes adding the ‘Dissent from secondary use of GP patient identifiable data’ code (Read v2: 9Nu0 or CVT3: XaZ89) to my record as well as the ‘Dissent from disclosure of personal confidential data by Health and Social Care Information Centre’ code (Read v2: 9Nu4 or CTV3: XaaVL).
I am aware of the implications of this request, understand that it will not affect the care we receive and will notify you should I change my mind.
Signature: Full name: Address:
Postcode: Date of birth: NHS number (if known):
Further information about the care.data programme is available online www.care-data.info
Copies of this leaflet can be downloaded at http://optout.care-data.info
