'Lapses' in handling of NHS data
Patient records have been sold to a range of private bodies including insurance companies, a damning new review has found.
The NHS made "significant lapses" in the handling of patient data, the report concluded.
The review into the data dished out by the NHS Information Centre (NHS IC) found that people's data could have been used "improperly" because the strict data-sharing arrangements which should have been in place to protect the information were lacking.
The NHS IC ceased to exist on March 31 last year and its operations have now been resumed by the Health and Social Care Information Centre (HSCIC). Even though the review has focused on the old body, it has made a series of recommendations to the HSCIC for future handling of health records.
The news will come as a blow to those behind the new care data scheme - which aims to give health providers and researchers a better look at what is happening to the health of the nation through data collected from their GP records. The records are to be held centrally by the HSCIC.
The review, chaired by Sir Nick Partridge, non-executive director of the HSCIC, shows that between 2005 and 2013 there were 588 "data releases" to private sector organisations, with medical information passed to pharmaceutical companies, insurance providers and to data analysts.
Although information did not name patients, in some cases it would have been possible to identify people through the information provided.
Sir Nick's review found that there were "significant administrative lapses" in recording the release of data. In some cases the decision-making process as to why the data was released was "unclear" and records of decisions incomplete.
"It disappoints me to report that the review has discovered lapses in the strict arrangements that were supposed to be in place to ensure that people's personal data would never be used improperly," the review states.
In two cases there was no record of which organisation even received the data.
The public "would not tolerate" the vagueness in regard to the handling of patient records, Sir Nick said.
He stressed that no individual ever complained that their confidentiality had been breached as a result of the data releases, but added: "It does not excuse errors that, even if having no negative consequence, still would create concerns for the public about the controls that are in place."
Sir Nick has made a series of reviews to the HSCIC which have been accepted in full.
HSCIC said it wanted to "draw a line under the past".
"The HSCIC must learn lessons from the loosely recorded processes of its predecessor organisation," Sir Nick said.
" The public simply will not tolerate vagueness about medical records that may be intensely private to them. We exist to guard their data and we have to earn their trust by demonstrating scrupulous care with which we handle their personal information.
"Although there is a new board and largely new senior executive team, the HSCIC inherited many of the NHS IC procedures and staff. This included data agreements with organisations, which have been highlighted by my review and which will subsequently be listed in future versions of the register of all data releases, first published by the HSCIC in April. We can now make sure we conform to recent legislative changes, so that data is released when it will benefit the health and social care system."
"I am happy that the HSCIC board has accepted my recommendations, which I believe will help build a robust, rigorous organisation that the public appreciates is working on its behalf. Without that external trust, we risk losing our public mandate and then cannot offer the vital insights that quality healthcare requires."
Andy Williams, HSCIC's chief executive, said: "In the interests of building an organisation which gains public confidence, I want to draw a line under the past. It is vital we learn valuable lessons from a previous time but we need to move forward now and focus on ensuring our processes and decisions are robust, clear and transparent.
"The valuable work that the HSCIC does for the health and social care systems needs the endorsement of the public if it is to be effective. We want people to be certain their choices will be followed, clinicians to feel supported in their roles and data users to know where they are with us."