Apollo patient data mining software may breach DPA

A primary care IM&T adviser has recommended that GP practices do not use Department of Health supplied software to extract data for a patient survey because of concerns over patient confidentiality.

Dr Simon Barton, GP IM&T adviser for Cornwall, wrote to all practices after the DH issued instructions to practices on how to use software from Apollo Medical Systems to extract patient-identifiable data for its GP Patient Survey entitled “Your Doctor, Your Experience, Your Say.”

The survey, which is also the subject of a separate dispute between GP representatives and the DH over the content of the questions, is designed to ask patients who have recently been seen in practices about their experience of getting access to services as part of a directed enhanced service (DES) scheme.

Dr Barton has advised GPs who want to take part in the survey to instead allow the data to be extracted from the NHAIS registration system. He claims GPs should be wary of allowing information to be extracted from their systems and sent to MORI, the company carrying out the survey, because as data controllers they are responsible for complying with the Data Protection Act.

Dr Barton says the Information Commissioner’s guidance on how the act should be interpreted for health records means that legitimate reasons for releasing personal data are if the patient has given informed consent, if it is required by law, if it is required by the NHS for administrative purposes and the data will remain within the NHS or if an acceptable data sharing agreement is in place which defines how the third party will use the data, their own security arrangements and employee confidentiality agreements.

He says the DH’s own letter to practices says data cannot be released “until data sharing agreements are in place” and claims practices faced unnecessary haste to sign up to using the software,

He told EHI Primary Care: “The Department of Health sent out the letter to practices the week before last and it arrived on the Friday, just before half term. Practices were told they then had to download the software and click ‘yes’ to the conditions by the following Wednesday to enable names and addresses to be sent to MORI. I think it’s a slightly bullying letter which was done in such a rush that practices couldn’t take a considered view on it.”

Since then, the deadline for downloading and installing the software has been extended to 1 November. But Dr Barton’s advice not to use the software remains.

A spokesperson for the Information Commissioner’s office told EHI Primary Care that if a data sharing agreement was in place between MORI and the NHS the extraction of data would not be in breach of the Data Protection Act.

However, she added: “If there was a breach of confidentiality at MORI the NHS would be responsible for that.”

A letter from the DH to GPs on data extraction for the survey says both proposed methods, using Apollo software and via NHAIS, will meet Data Protection requirements.

It adds: “For both methods no patient details can be passed to the GP Patient Survey provider until the data processing agreements to meet requirements under the Data Protection Act are in place.”

Related documents

DH letter to practices on data extraction for the GP Patient Survey