medConfidential Bulletin – 15 March 2024

[humanbean]

The online version of this bulletin, including all the links, can be found here :

medconfidential.org/2024/me...

Hello again from medConfidential,

It’s been a while since our last newsletter, and if you signed up to find out if NHS England would provide more details to help you with your choices around its half-billion pound Palantir platform before it “goes live” at the end of March, the answer is now clear. They won’t.

NHS England has said pretty much nothing new in public since before Christmas. The ‘Department of Health in England’ is instead leaving you to puzzle out the process, and to do all the work. As of this newsletter, your choices boil down to this:

If you want to express your objection to your NHS data (“confidential patient information”) being used for purposes beyond your care, i.e. to opt out, you should use this paper form for your GP and post this paper form to Leeds for your kids and you.

(If you’re single and over 13 years old, this online page works only for you – and NHS England states that this opt out will not apply to the Federated Data Platform, which rather undermines it as a so-called ‘National Data Opt Out’…)

For other data flows around your direct care, you should ask your hospital doctors what your hospital currently does and what your choices are there.

Please note: in the current situation, your GP Data Opt Out is just as crucial as your National Data Opt Out.

What’s going on?

Your GP sees you as a whole patient; they know it’s important to maintain trust in your family doctor. The Department of Health in England clearly doesn’t share this concern, and – though they’re not being entirely transparent about them – NHS England’s plans and actions show they intend your GP data to be copied again and again.

For example, the Frequently Asked Questions for the Palantir Project state:

“…if there is data sharing agreement between integrated care system (ICS) and GPs locally to share data for care co-ordination then they can use the local version of FDP for that purpose.”

There are many such agreements across England, and once your data is in Palantir, it can be “federated” – i.e. copied – again and again.

NHS England’s Board were told in December 2023, “Absolutely, primary care data can go in” [time code 1:43:20] and “For direct care, it’s not in their [patients] interests to opt out, but they can” [time code 1:48:30]. And in February, the Government confirmed that GP data could be “brought in” to Palantir and Ministerial answers show they are content for NHS England to break past promises to be transparent and honest about how they use your data.

What just happened?

Last week’s Budget effectively mandated Palantir for NHS Trusts and ICSs, even after the public were told it would be ‘optional’. And the public’s views won’t even be listened to until later this year, when it may be too late for many.

Budget week obscured another unauthorised data collection of all GP records across England, which was inadvertently revealed on NHS England’s official GitHub page.

On that page, officials at the Department of Health in England stated in terms that “the aim is to grab the data” from every patient in every GP practice. (This, despite having strenuously complained at medConfidential’s characterisation of its GPDPR programme, less than three years ago, as a “GP data grab”…)

The ultimate intention, as ever, is for the Department of Health in England to sell (access to) patients’ data in one form or another. As with previous attempts, officials didn’t inform GPs, who are responsible for their patients’ data in law. Instead, a team at NHS England wrote code to simply “grab” the data… because they could.

This story is still emerging, but NHS England’s denials don’t match its actions thus far. And, as with their continued secrecy around Palantir, Department of Health in England officials don’t appear to think alternative perspectives on their intentions are worth considering – or even seeking.

Looking forward, legals and otherwise

Lawyers are lawyering about Palantir – our best advice for most people is to make your own choice for yourself and your family, and to leave the lawyers to do their work. (We’ll continue to help them.)

Legal action involves more than just ensuring government bodies follow their own rules; it’s about ensuring that they follow the law. We’ve never received clear answers from NHS England on this, only statements that they will “comply” with policies that they themselves have written to permit them to pursue their own desired actions.

This is far from reassuring. Whether it is legal or not remains to be determined.

Decisions made by the Department of Health in England’s “Privacy, Transparency, and Trust Unit” fail to provide patient privacy and professional confidentiality, have self-evidently failed to provide meaningful public transparency, and – combined with the actions of the body it is supposed to ‘challenge’ – critically undermine trust in both the process and the wider NHS. (Legally-speaking, this deficit of robust, coherent internal processes makes it unlikely NHS England will be able to present such things to a court of law.)

The Federated Data Platform was meant to “end the era of chaos” in health data. But while a platform like Palantir could in theory make secrecy much harder, NHS England seems as determined as ever to try to keep its uses of – and ambitions for – your data hidden.

Unfortunately, the next Election won’t protect your NHS data; Opposition statements and actions already show the next Government won’t do any better than the current one.

The culture of data grabs continues spreading all across UK government, fuelled by tech salesmen promoting their platforms, magic thinking about tech not people, and officials (and others) with their own agendas. And even if the companies don’t make a sale, they embolden those who seek to operate without constraints – and who disregard the rules that are there to protect you.

What you can do

If you want to express your objection to your NHS data (“confidential patient information”) being used for purposes beyond your care, i.e. to opt out, you should use this paper form for your GP and post this paper form to Leeds for your kids and you.

(If you’re single and over 13 years old, this online page works only for you – and NHS England states that this opt out will not apply to the Federated Data Platform, which rather undermines it as a so-called ‘National Data Opt Out’…)

For other data flows around your direct care, you should ask your hospital doctors what your hospital currently does and what your choices are there.

You may also want to tell your friends and other family members about this, and/or forward this Bulletin to them with a short note of your own.

Finally, if you are in a Patient Advisory Group for a hospital, an ICS or your GP practice, please do ask for official answers on what information patients will receive on the ‘Palantir Platform’ / Federated Data Platform, and what their choices will be about their care and the use of their data as a result. The (lack of) guidance and meaningful options for patients should be on record.

NHS England’s Board were told that patients would be able to make different choices about their care and their data; NHS England itself is refusing to give guidance on implementing those choices. Should this situation continue, things may come down to NHS doctors being forced to present their patients with the ultimatum, “Your data or your life” – as dictated by Palantir and the Department of Health in England.

This entry was posted in News on March 15, 2024 by medcon.

[Zephyrbear]

How does this data grab affect the devolved NHS administrations? Are they involved with Palantir too or not? All I’ve seen in these discussions is references to NHS England but nothing about Wales (which is where I am) or Scotland or NI.

[humanbean in reply to Zephyrbear]

Sorry, I don't know the answers to your questions. I receive the medconfidential bulletin via email because I signed up to their mailing list. It was only recently that I decided to share the bulletin on the forum. Before that it hadn't occurred to me.

This is the front page of the medconfidential website :

medconfidential.org/

and it has a search option part way down the page.

All I can remember is that there was lots of news about the first NHS data grab in England some years ago, but at the time Scotland wasn't included. I don't know about Wales and NI. Then sometime later NHS Scotland got a mention too because that data was going to be grabbed. I can't remember Wales or NI ever mentioning their data was going to be grabbed too. But relying on my memory on this subject would be a big mistake, so people will have to do their own research.

Based on the info in the latest bulletin I would say the parent organisations i.e. NHS England, NHS Scotland, NHS Wales, and NHS Northern Ireland probably can't be trusted to give full and accurate information on what they are doing with people's health records.

People should remember that Palantir is an American company, and once their data has been taken to the USA it can never be taken back again. I suspect they already have all the hospital data, but now they want the GP data too. Also Palantir doesn't have a particularly savoury reputation.

This is what Wikipedia has to say about Palantir and the NHS. It isn't very informative, sadly.

en.wikipedia.org/wiki/Palan...

[humanbean]

I am always amazed about data grabs of medical records in that people forget this includes their children's data too. When this issue first started being mentioned there was a chunk of adults who opted out but decided not to opt out their children. I even read a comment from someone who said they would leave the decision up to their children when they were older. What is the point of that??? Those parents have left their children exposed in ways that the parents might not even be able to guess at until they (the children) are much older.

I worry that uses for private health data will spread and spread, because the idea of privacy is getting more and more watered down.

These are my worries about medical data sharing :

1) Insurance companies will be given access and can decide whether to insure you. Insurance is already really expensive, and prices for some people will rocket, others might not get insured at all.

2) Potential employers will get access and can decide whether to employ you on the basis of your health. This doesn't affect me since I no longer work, but for people who do work this could be catastrophic. The visibly disabled already have a hard time getting jobs, but the invisibly disabled could find it impossible to ever work and earn a living. And what about people with something like hypothyroidism? That can take years to get diagnosed, and many, many visits to doctors who don't test, so employers might never see a diagnosis, they just see someone they assume is a hypochondriac with lots of visits to doctors which amount to nothing for years.

3) Records will almost certainly escape into the wild.

4) I bought a copy of my GP records in 2014. I had to sign a form saying that I accepted my GP could remove records from the copy without mentioning it to me if they decide it might damage my mental health or mentioned third parties. What do those removed records say? In future, random staff from all sorts of organisations could end up having access to records that I cannot see that will affect my life in future. How can someone defend themselves against accusations they can't see or read?

5) I really don't trust doctors not to have removed records from the copy that they themselves wrote which turned out to be wrong or which were both insulting and wrong. I also know from the records I did get that doctors routinely minimise what I have said, misunderstand what I have said, omit things I have said, and their summarisation of any letters or records from hospitals is absolutely diabolical. I've had operations that don't even get a mention in my GP records at all.

6) If someone is going to have a copy of my medical records it would be very slightly less concerning to me if those records were actually accurate, rather than I was being judged on records which were untrue, or misunderstandings by doctors, were incomplete, or just plain wrong.

7) And let's not forget that some medical problems are simply embarrassing and people don't voluntarily discuss them with anyone. But there could come a day when your boss knows about it, whether you like it or not.