No single opt-out on medical records database

Patients will be unable to make a single request for their records not to be held on the NHS Care Records Service. Instead they will have to ask their details are not recorded onto the national medical records database each time they deal with the health service.

Any patient who does not want their medical information held on the NHS CRS Service will only be able to do so if they can demonstrate they will suffer significant distress or damage, and will be required to prove this afresh each time they come into contact with an NHS service.

The apparently cumbersome opt-out policy adopted by the National Programme for IT’s programme board has been outlined by NPfIT’s Caldicott Guardian Phil Walker in a letter to a GP.

Dr Mark McCartney, a GP in Pensilva, Cornwall, wrote to NPfIT at the end of January because one of his patients had requested that their personal information was not stored electronically via the NHS Care Records Service.

Walker told Dr McCartney that the right of a patient to opt out of having information about them recorded within the NHS CRS was covered by the Data Protection Act 1998. The right is separate to mechanisms by which patients can request that their details held on the national database not be available to health professionals other than their doctor.

He said: "This permits a patient who feels that they are suffering, or may in future suffer, significant damage or distress to ask for the processing of data to cease, including the holding of data.

"The process by which a patient may demonstrate the required level of damage or distress is still being considered but will need to be in place prior to NCRS going live with clinical details included."

Walker said that if a patient was successful in demonstrating the required damage or distress data would be removed from the systems. However he added: "If the patient re-presents for subsequent NHS care there will be a new entry of data and the patient will need to again establish that they are suffering, or may suffer, significant damage or distress."

Dr McCartney told EHI Primary Care that the reply had been helpful but criticised the requirement for a patient to show distress each time an NHS contact was made.

He said: "It doesn’t seem to be a realistic opt out and the greater risk is that it will lead to the quality of information that’s recorded being more vague and general."

Walker told Dr McCartney that there were other ways in which the patient might protect their information such as using access controls which would mean that only the organisation that entered the data would be permitted to see it.

He added: "The use of sealed envelopes, which should be available just about the go live time for NCRS will allow your patient to put particularly sensitive details under seal, perhaps allowing you and no-one else to see them without consent except in emergency situations."

Walker said that he hoped the process by which patients could demonstrate distress would be in place before clinical details went on the NCRS which he said was planned to be in the autumn of this year.

Dr Paul Cundy, chairman of the joint GPC/RCGP IT committee, told EHI Primary Care that it was not up to the NPfIT to dictate what rights patients had over information held on the NHS Care Records Service.    He added: "I don’t give a fig what the NPfIT Caldicott Guardian says. It’s not up to the National programme for IT and the government to decide on this, it’s up to the profession and patients."

Dr Cundy said the BMA had not finalised its position on NPfIT’s opt out policy and planned to hold a conference to debate the issues.He added: "We will then aspire to provide the national programme with an informed and debated view from the profession and patients as how we think it should work."