HSCIC review finds data release ‘lapses’

The Health and Social Care Information Centre’s Partridge review has found “lapses” in how its predecessor organisation shared patient data.

The issues uncovered by the review of releases by the NHS Information Centre include two instances in which it was impossible to discover who information had been released to. 

The review, undertaken by HSCIC board member Sir Nick Partridge, sets out a series of measures to guarantee greater openness and reassurance to the public, stricter controls over data use, and better clarity for data users.

Sir Nick said in a statement: “The public simply will not tolerate vagueness about medical records that may be intensely private to them. We exist to guard their data and we have to earn their trust by demonstrating scrupulous care with which we handle their personal information.”

Over eight years, the NHS IC authorised more than 3,000 releases of data, including 588 to private sector organisations. For the review, Pricewaterhousecoopers examined some 10% of the releases authorised over the period. In two cases, it was not possible to identify the organisation that received the data.

Speaking exclusively to EHI, Andy Williams, chief executive of the HSCIC, said: “Two instances in 3,059 is two too many. Even one is too many.”

Williams said that there were lapses in processes and record keeping, meaning that the appropriate records could not always be found. “We need to tighten up processes and to be more transparent in our decision making. We also need to have increased sensitivity around the audibility of contracts so we can be sure that data is only used in approved ways.”

Although the problems occurred under the NHS IC, Williams said the way data was released was in keeping with the prevailing policy imperatives at the time. “The issues are down to the direction of travel at the time. There was a clear goal to get data out to enable it to be analysed and used. We still need to do this but now we also want to have proper protections in place.” 

The review period runs up to April 2013. Asked whether similar problems still existed at the HSCIC, Williams said: “No. Almost certainly not. We’ve committed to publish all data releases post April 2013 on a quarterly basis.”

The Partridge review says that the biggest category of data releases was of the Hospital Episode Statistics, where releases were managed by Northgate. The report says PwC “could not find evidence that Northgate got permission from the NHS IC before making releases, as it was supposed to.”

The release of HES data is particularly sensitive, as it forms the heart of the care.data programme. NHS England wants to create care.data by linking an expanded version of HES to other datasets, starting with GP data, and to release it to researchers and others.

The programme has been delayed by an outcry over who will have access to the data and about the consent model, with privacy and medical bodies arguing that patients should opt-in rather than out, or that data should be pseudonymised at source.  

In medical research, the Partridge review found that of the 591 approved medical research projects receiving data, nine did not have the required Office of National Statistics Legal Gateway approval. The research studies have been unauthorised while they secure the necessary approval. 

The Partridge review was launched by the HSCIC in March, after instances came to light of HES data being released by the NHS IC in circumstances that the supporters of care.data had argued would not happen. 

The report says: “The conclusion that I draw from this evidence is that the system did not have the checks and balances needed to ensure that the appropriate authority was always in place before data was released. In many cases the decision making process was unclear and the records of decisions are incomplete.”

The report adds: “There was no single gateway into the NHS IC where data requests could enter and there were too many disparate, disjointed processes for the sharing of data. The process for ensuring the appropriate deletion of data at the end of an agreement was inadequate.”