Private data contracts risk ‘undermining core values of NHS’

The contracting of private technology firms to handle NHS data risks undermining the “core values” of the health system, a lawyer and campaigner for tech equality has said.

Cori Crider, the co-founder and director of tech justice firm Foxglove Legal, warned the “creeping privatisation of data assets” risks losing patient trust in the NHS.

Speaking to Digital Health News about Palantir’s contract to deliver the NHS Covid-19 Data Store, and reports the artificial intelligence firm could be drafted in to bolster NHS Test and Trace, Crider expressed concern that the company was appointed with little scrutiny.

“There’s a general kind of anti-democratic question. All of this is going through at the moment without a very significant public debate,” she said.

“In many ways the creeping privatisation of data assets, and the introduction of what are essentially security firms into the health service, really risks undermining what I think of as the NHS’s core value, which is a free public service equally accessible, available and trustworthy to everybody in the UK.”

Crider said the move towards digitising the NHS and creating a better view of patients through data cannot only be about the technology.

“We’re all having a lot of conversations now, of course, about the future of the NHS and I think that it can’t just be ‘is the software good?’ It’s got to be ‘is the company moral and trustworthy?’,” she added.

“These are very core questions about the future of the National Health Service. I will be the first to say I’m very happy with the idea that our doctors and nurses should have the best data systems that they can have, but the systems also need to be democratically acceptable and people need to know about their work, and know exactly what is being done with a company’s access to the most sensitive data that people have.”

Palantir was contracted in March 2020 by the NHS to help develop the Covid-19 Data Store for a fee of £1. The contract was due to expire in June but was extended for four months at a cost of £1million.

NHS England and Improvement are currently seeking a supplier continue work on the NHS Covid-19 Data Store at the end of the extended contract. A supplier is expected to be chosen by the end of 2020.

Digital Health News understand the contract could be worth up to £18m a year over five-years, totaling almost £100m by completion.

Crider believes it is unlikely the contract will go to a new supplier as Palantir has built, and is running, the analytical dashboards currently used by the Data Store.

She said there is a risk of vendor lock-in, adding that “it will be harder and harder to get them out of there”.

Palantir is among a suite of private tech firms hired to help deliver the NHS Covid-19 Data Store and other Covid-19 responses. Google, Amazon, Microsoft and AI firm Faculty all hold contracts to work on the platform.

Faculty, which has links to Boris Johnson’s former senior aide Dominic Cummings after working with him on the Vote Leave campaign, was contracted in early 2020 for work on the NHSX AI Lab but was redirected to help run the NHS Covid-19 Data Store shortly after.

The contract amendment saw the company paid £2.3 million for its work on the data platform. At the time cabinet minister Lord Agnew, who oversees Government Digital Services, held £90,000 shares in the company, though it was determined there was no conflict of interest.

The government faced fierce backlash for failing to publish its contracts with the tech firms, some of which began in February 2020. The contracts are awarded under the GCloud framework, which does not require the awarding body to publish a tender but does require the process for choosing the supplier to be documented.

Crider and Foxglove Legal, alongside openDemocracy, brought legal proceedings over the lack of transparency surrounding the government’s deals. The contracts were eventually published in June just hours before proceedings were due to start.

The documents revealed Faculty and Palantir were originally granted intellectual property rights to train their technology and profit off access to NHS data.

According to a privacy notice relating to the NHS Covid-19 Data Store both Palantir and Faculty only have access to pseudonymised and anonymous data. An NHS spokesperson said any intellectual property was owned by the health service.

A spokesperson for Faculty said the company “cannot and would not use” data from the Data Store outside the NHS.

“Faculty is not a data company, nor a data aggregator; we are an AI technology company. Our business model is not based on the monetisation of personal data, or on reusing data between customers, but on applying AI to build and run the models and applications that increase the business performance of our customers,” they told Digital Health News.

Implications for mass surveillance

Amnesty International has also raised concerns over Palantir’s involvement with the Data Store, specifically around how the company can use NHS data.

Matt Mahmoudi, an advisor on artificial intelligence and human rights at the organisation, told Digital Health News “we don’t have a 100% clear cut answer” from Palantir on whether the data collected with be used to train machine learning applications for other products.

Palantir has previously been trailled by London’s Metropolitan Police and has been drafted in to oversee the UK’s post-Brexit border and customs data. But the firms ongoing partnership with the US Immigration and Customs Enforcement, the department charged with deporting undocumented migrants, has sparked controversy.

There are “massive implications for mass surveillance” if patient data is being used to train other products provided by the company, Mahmoudi said.

“From the surveillance perspective, of course, the worry is that a lot more data is gathered than is needed in order to help prognosticate how the pandemic is moving, or to do track and trace, or whatever it is that the remit is for the data store contracts,” he added.

“To me, the biggest worry is also having these invasive measures outlive the pandemic. We have put in this state of emergency under Covid-19, in which quite invasive practices in cooperation with tech companies becomes possible.

“But we haven’t quite figured out how and when we’re going to sunset those deals, or sunset those invasive practices.”

Palantir was contacted for comment.