GPs urged to be ‘constantly alert’ on privacy

Tags: BMA Confidentiality consent GPs SCR Summary Care Record UCL

12 Jun 2009

GPs have been advised to be “constantly alert” to potential threats to patient confidentiality and privacy as their representatives back an opt-in model for data sharing.

This week’s National Local Medical Committees’ conference supported a five point motion which backed GPs role as data holder for patient records, called for an opt-in approach to transfer of identifiable information and demanded that patients should be able to ask for a list of when their Summary Care Record has been accessed and by whom and objected to “obstacles” placed in the path of those wishing to restrict access to their records.

The motion was enthusiastically supported by LMC representatives according to Dr Grant Ingrams, co-chair of the BMA and Royal College of GP’s Joint IT Committee, who claimed that potential threats to patient confidentiality and privacy are increasing all the time.

Dr Ingrams told EHI Primary Care: “The growth of electronic records means its becoming easier and easier to extract more and more data. I am now contacted on almost a weekly basis by an LMC who wants to know whether a local plan is acceptable or not. Sometimes it’s quite reasonable but sometimes it’s driving a coach and horses through the rules and there is no pretence of protecting patient privacy and confidentiality.”

Dr Ingrams advised GPs to be “constantly alert” to potential threats to patient confidentiality which he said had been typified by the government’s now abandoned proposals to allow widespread data sharing between different Whitehall departments.

On the SCR Dr Ingrams said he felt the “average” doctor was now happy with the ‘consent to view’ model for the SCR which means patient data is uploaded on an implied consent basis but that patients must give their consent at each medical encounter before information is viewed.

However Dr Ingrams said he was still concerned about other aspects of the SCR which had been raised by the independent evaluation conducted by University College London, including criticisms of the effectiveness of the initial information campaign.

Dr Ingrams added: “The public information campaign has got to be more effective than it has been so far. In the early adopter areas the UCL evaluation found only one in seven patients knew what the SCR was after the campaign. It’s got to be better than that.”

Dr Ingrams said the LMCs’ debate showed GPs were still very much concerned about ensuring patients privacy is protected.

Fiona Barr

Reader's Comments

Data Controller

Neil.Bhatia@nhs.net

12 Jun 09 12:06

GPs will not be the data controller for a patient's SCR.

What happens to their uploaded data will be beyond their - and their GP's - control.

confidentiality

16 Jun 09 23:06

How would a patient know who had had access to their records? A national database stigmatises patients with mental health problems. Visit any general hospital, the minute they now there is a mental health history you can see a change of attitude and how patients are treated.

Records are lost on laptops and memory sticks, anyone in the NHS can accees records and the patient has no means of checking who that person mught be.

The system is not safe, and never will be. Anyone can obotain a copy of their medical records and have copies of letters etc as they are issued so why do we need to keep going in line to check.

I obtained my health records and was absolutely shocked and the number of errors,critical errors at that, in just a ferw pages. Medication was listed as 50 mg which was aboe the leagl dose allowed outside hospital, instead of the correct does of 15 mg daily.

The NHShas a very long way to go to gain my conifidence in any database, confidentiality compliance or anything else. I want my records to remain with my GPwhere they have been kept safe and secure all my life.

Personal Privacy Promise

22 Jun 09 13:06

I had an interesting and frank discussion with ICO staff at one of their recent conferences on the question of the PI Promise. I pointed out that the 7th promise states that we would "have effective safeguards in place to make sure personal information is kept securely and does not fall into the wrong hands;". When I challenged this wording on the basis that it was an impossible promise for any organisation to meet, I was told that I was ignoring my Data Protection duties. Interesting to note that others recognise the realities of working in the NHS.