View data

The consent model for the NHS Summary Care Record seems finally to have been decided: so the debate has shifted to detailed care records and the Secondary Uses Service. Fiona Barr reports.

Implied consent to upload, explicit consent to view, legitimate relationships, role-based access control and section 10 opt-outs.

The language of how to protect patients’ personal data in an electronic world has developed rapidly over the past few years; even if it is less than familiar to many patients.

In recent weeks, interest has intensified with the announcement of a new consent model for the NHS Summary Care Record, plans to investigate consent to view for Detailed Care Records and the launch of a consultation on the Secondary Uses Service.

The revised consent model for the SCR means basic information – such as medicines and allergies – will be uploaded from GP records under implied consent. Information will only be viewed with a patient’s explicit consent at each encounter.

Dr Gillian Braunold, NHS Connecting for Health’s clinical director for the SCR, hopes this will finally put to bed concerns over the consent model and mean instead that discussions can switch from consent to content.

However, while the temperature of the debate on consent may have been turned down, there are some outstanding concerns. British Medical Association policy, as ratified at its annual representative meeting, is that access to electronic records should require explicit consent.

Consent to view delivers explicit consent at the point of access; but concerns remain about how informed patients will be about their data being uploaded in the first place.

Dr Vivienne Nathanson, head of science and ethics at the BMA, said it had been involved in discussions on the new model and welcomed the changes “pending finer details.”

She added: “If the shared care record is to be a success, it is paramount that patients are fully informed about the consequences of their decision to opt-in or out. We hope that the changes proposed by NHS Connecting for Health will reflect this view.”

Dr Paul Cundy, a Wimbledon GP and outgoing co-chair of the Joint IT Committee of the GPC and Royal College of General Practitioners, also argues that CfH needs to improve its record on informing patients about the SCR.

The University College of London evaluation of its early adopter sites conducted 100 interviews with patients and found that a high proportion did not recall having received information about the SCR or the HealthSpace public portal, despite an extensive public information programme.

Dr Cundy says: “Accepting that there will be an implied consent model, we have to have better communication about it. The UCL evaluation found only one in seven had heard about it.”

Dr Paul Thornton, a GP in Warwickshire who has been a long-standing campaigner against the consent model for the NHS Care Records Service, argues that explicit consent at the time of upload is essential.

“The changes to the consent model do not solve the problem that the publicity does not work. You still need explicit consent to upload because the need to get consent to view can be overridden in certain circumstances.”

Dr Nathanson says the BMA also needs reassurance that only those with a legitimate reason to view electronic health records will be able to do so and that the audit trails will “rapidly identify and stop any inappropriate access.”

Meanwhile, on detailed care records one of the problems that CfH faces is that primary care software suppliers like TPP and EMIS are forging ahead with systems that make sharing of information possible while the debate around the consent model is still being held.

A spokesperson for CfH confirmed to EHI Primary Care that the NHS Care Records Service programme Board is considering a proposal to apply a ‘permission to view’ model for the sharing of clinical information across organisational boundaries but no further details are available as yet.

Again, Dr Thornton argues that patients should have to give their explicit consent to ‘making information available’ so that it can be viewed across organisational boundaries, well before the opportunity to give consent at the point of care arises.

However, Dr Simon Bowers, GP clinical IM&T lead for Liverpool PCT, who is pioneering information sharing in Liverpool using EMIS Web, says he has never had a single patient decline to give consent. “Every single one says ‘I thought you could do that anyway,’” he told a recent EMIS conference.

Within this context, the NHS has also launched its consultation on the use of patient data by the Secondary Uses Service. It has said that patient data will be collected automatically from the NHS CRS, Choose and Book and other national systems without explicit consent – but with the option for patients to apply under section 10 of the Data Protection Act to prevent use of data that would cause them distress.

This has already raised some concerns, in particular from faith groups such as the Catholic Bishops Conference, who say Catholics may have ethical and moral objections to the purposes for which their data is used. The debate on consent and electronic records has some way to run yet.