Summary care record is indelible

Tags: DH GP PCT SCR South Summary Care Record

07 Apr 2009

Patients who do not opt-out of the Summary Care Record prior to one being created for them will not be able have their record deleted later, it has been revealed.

If a patient subsequently opts out of the SCR their record will be ‘masked’ and become inaccessible by NHS staff, but it will not be deleted.

The reasons given by the DH are a combination of medico-legal requirement, to preserve a future audit trail; and technical explanation that the way the system has been prohibits deletion of individual records.

The clarification on the indelible nature of each SCR comes in a response to a Freedom of Information request made by GP Dr Neil Bhatia last month.

Dr Bhatia, who is vigorously campaigning against the system, requested details of the mechanism by which patients at Bury PCT could get their uploaded SCR completely deleted if they had initially opted-in to the system and later changed their mind.

In its response to Dr Bhatia’s FOI request the PCT said: “If the patient changes their mind later, after a record has been created, we have to retain a copy of the record for audit trail since it may be required to demonstrate the reasons behind a previous clinical decision.

“However, the SCR would be made unavailable from the moment that the patient no longer wished it to be used, so that no access is possible in a care situation. Therefore, there is no form available to have the record completely deleted if the patient has a record created in the first place.”

The response goes on to explain that the 93C3 read code, which is used to identify patients who do not wish to have an SCR, means that when the record is synchronised with the national Spine database, a blank care record will replace the existing SCR for that patient. However, this does not delete the original record, but instead ‘masks’ it.

An NHS Connecting for Health spokesperson reiterated Bolton PCT’s response saying: “A patient may opt out before a SCR is created. If the patient changes their mind later, after a record has been created, we have to retain the record since it may be required to demonstrate the reasons behind a clinical decision.”

The latest clarification on the operation and technical design of the SCR service raises concerns that patients are not aware that once they have opted-in to the summary care record they will not subsequently be able to have their data removed.

Information leaflets given to patients at numerous PCTs, including South Birmingham and Stoke-on-Trent, tell patients that they will be able to change their mind about the SCR at anytime.

Dr Bhatia said: “You have one chance to prevent your medical records from being stored on the NHS database for eternity.

“The only way to prevent this is by opting-out of the NHS database. You cannot change your mind once your records have been uploaded.”

In March NHS Connecting for Health has dropped the requirement for patients to appear in person if they wish to opt out of having an SCR.

Related articles:

Read code will trigger care record opt-out

Personal appearance for SCR opt-out

Sarah Bruce

Reader's Comments

Deletion never was an option

07 Apr 09 13:04

Is the complaint here that those pursuing candidate terrorists and fly tippers via the Summary Care Record are unlikely to respect the 'mask this record' flag?

Maybe so, but even if the record were removed from the live SCR database the 'deletion' of records on enterprise systems is not like deleting and overwriting a file on your PC.

1. Transaction logs on the live database may preserve the data.

2. Records cannot practicably be deleted from historical off-line backups taken of the 'live' database.

3. What about data passed from the live database onto 'data warehouses' / secondary use systems? Indeed it's likely that fishing expeditions would be performed on these rather than the live 'spine' SCR anyway.

Ergo 'deletion' never was an option.

re: Deletion never was an option

Neil.Bhatia@nhs.net

07 Apr 09 17:04

1) Agreed 2) If you say so 3) Quite possibly

So yes, perhaps it was never an option. It was certainly suggested that it would not be as far back as 2006 in the national press.

But now we know for sure.

So now it's clear.

And it's one more - now verified - thing that people should consider before allowing their records to be uploaded. Once uploaded, never deleted.

What happens if the uploaded record is wrong...

07 Apr 09 23:04

A number of questions arise:

1) What happens if the uploaded record is wrong? How is incorrect data identified/removed? Suppose that you have been incorrectly labelled with a stigmatising illness such as epilepsy, diabetes, alcoholism, HIV etc.

2) What happens if the upload occurred in error? How will this problem be corrected?

A record created in a data centre by multiple participants with no one responsible for accuracy and which cannot be deleted means that there is a risk of clinical decisions being made on incorrect data.

Further holding clinical data for longer than is absolutely necessary for clinical care to be delivered is against the Data Protection Act. It is a matter of some concern that data centres will hold potentially inaccurate data in non-anonymous form, so that fishing expeditions can be undertaken by unknown third parties.

I cannot see how the summary care record serves either the clinical or the patient community safely in a way that is a substantial improvement of current medical practice.

re: What happens if the uploaded record is wrong...

Neil.Bhatia@nhs.net

08 Apr 09 10:04

1) Not sure, possibly overwritten IF the GP record was subsequently corrected. However, if your GP refuses to correct your record....

2) Too late. Cannot be rectified - the GP (no longer the data controller) cannot place that patient in the same position as if the upload had never happened. Best you could do is mask the visible record and, as a GP, hope your patient doesn't take the matter any further.

Article 16 of Regulation (EC) No 45/2001 of The European Parliament - upon which our DPA was designed to comply with - gives everyone the right to erasure of their data if they believe that their data has been unlawfully processed. A patient could argue that this is the case in the scenario your describe.

The DoH says that the data cannot be deleted. But what if the European Court (or indeed our own high court) demands it?

Is it not unlawful to store data in a way deliberately designed to make deletion of that data "impossible"?

Article 16 of Regulation (EC) No 45/2001

stressfreedave@hotmail.com

08 Apr 09 12:04

Having been through the mill with the NHS over patent privacy in England and Scotland, I doubt Article 16 of Regulation (EC) No 45/2001 would be of any use to a patient. This is because you (the patient) would need to prove the data was processed unlawfuly, and since the vast majority of health data is shared with 'implied consent' it is almost imposible to prove it was unlawful, as to do this you would need to prove you were ether ignorant of something (something that is impossible to do) or said no in writing (verbal is no use as you cant prove that) and at the same time prove it was not in your best interest (this is not impossible as I have managed to do that, but does take a lot of effort)

Sharing records is key to NHS Development

08 Apr 09 13:04

Sharing records is key to the development of the NHS, the establishment of new pathways of care and better outcomes.

It is really sad that a 'paternalistic' approach is being taken by some GPs who believe they know best when acually most patients want this and believe we share electronic records now. Most are estonished when we tell them we dont.

For a system that will offer tighter controls than those in place with paper based systems, one that will improve diagnostic and treatment times and deliver better care outcomes, why are we still arguing.

Should we not be looking forward to the future and providing our patients with the Healthcare they so deserve.

Principles, principles, principles!!!

Can we make distinctions between sharing records and a centralised database?

08 Apr 09 13:04

I think sharing records between organisations for the purpose of specific care episodes is different than uploading an individuals record to a national database. If that is accepted as the case then we need to make that distinction.

In any event, if UK DPA legislation doesn't apply due to medico-legal requirements or technical impossibilities or whatever, then the DP legislation will need to be amended to reflect that.

Not sure in this case if it is a heavy paternalistic influence from GPs or other clinicians that is at stake here more likely to be a need for full transparency which should be the minimum requirement I guess. This won't be limited either to the UK as the same will apply the world over.

We might continue to enjoy freedom's? here in the future but one can only imagine the destructive power some regime's could wreak with this type of information flow.

Hung up on deletion

08 Apr 09 13:04

>>Is it not unlawful to store data in a way deliberately designed to make deletion of that data "impossible"?<<

As I implied by poster 1 - true deletion requires a standalone system without backups or logs. No one in their right mind would use these for clinical data! You need audit trails, secure off-site storage etc.

Check your own GP system's statement of RFA 99 compliance. You will probably find that you have NEVER deleted anything on it!

It's a mistake to get hung up on the word "deletion". It’s a crowd pleaser but I think it erodes your credibility in pursuing an extremely valid concern i.e. "how can data be put beyond use".

However we must define the uses and how far 'beyond' is enough.

Defining uses is at odds with the prevalent "store everything and work out what to do with it later" culture of electronic medical records which is by no means unique to NHS CfH.

The difference with CfH is the aspiration to provide a centralised store of everyone's health data.

Any reader of this website knows that there is a queue forming for either non-anonymised or pseudoanonymised data from CfH central repositories: intelligence and law enforcement agencies, other government departments, private healthcare providers, pharmaceutical companies and other commercial organisations.

This issue has at it’s heart not ‘deletion’, but the question of trust in the Government. Our politicians must establish constitutional protection for these data and limits on their use - and not override them when the first expediency arises.

Dr Malcolm H Duncan

RE: Sharing records is key to NHS Development

stressfreedave@hotmail.com

08 Apr 09 19:04

The idea is to have 2 types of data sharing, 1) to allow a relevant clinitian access to relevant data when treating you and 2) provide data for others for research etc. The problem is you can not have number 1 without number 2, yet when CfH, DoH, NHS, polititians and even the media talk about the programe, they rarely mention number 2 as if it is irrelevant.

To that there is the evr growing list of people wanting access (chemist etc).

Trying to build trust

09 Apr 09 13:04

The answers from CfH in the article are an indication of what this is trying to do, regardless of the technical constraints.

Whether you believe that the SCR is a benefit for patients or a breach of civil liberties is a different argument, however for it to have any chance of success there would have to be an initial level of trust in the system (with a gradual building of trust over time).

If the SCR is to be used to check current medication details extracted from the patient's GP record before prescribing (e.g. OOH, Specialist Nurse, temporary patient), the prescriber may be called to demonstrate their decision making process in the event of any subsequent investigation or audit.

If big chunks of this "historic" record have disappeared because the patient has susequently decided not to share that part, this won't be possible and could could even create risks (e.g. in a medication review when looking to see if all patients on a drug still need to be on it, if the initial trigger for the medication has gone, future issues could be stopped - even though they may still be needed by the patient).

Without the ability to view a historic snapshot, I can't see how anyone would be able to trust the system for prescribing - thus eliminating a lot of the potential benefits offered by this system.

Re: Sharing Records and establishing trust

13 Apr 09 15:04

Regarding record sharing, it would be intriguing to find examples that are better than 'standard' medical practice: sending an accurate letter from clinician to clinician, taking a proper history and being prepared for the worst when administering 'risky' drugs (eg anaesthetics).

The NHS's development is not hampered by lack of record sharing. It is hampered by instability of employment, inadequately skilled staff, management chasing targets and bonuses, budgeting mechanisms which create a 'no' culture and a failure to understand the concept of quality assurance.

In regard of the issue of indelibility, it is not what happens when everything functions perfectly that is at issue. It is what results when things go wrong!

My fear with the sharing of inaccurate, untrustworthy records is that poor clinical judgements are made which discriminate against patients, without their knowledge. Whereas inaccuracy in the written record has limited scope for harm (one institution), shared inaccuracy may have far more widespread effects.

My other fear is that patients might not be able to obtain a mortgage because the associated life assurance is denied due to the incorrect, indelible placement of a diagnostic code in my record which is seen and sold by an unknown third party, against whom there is no redress.