"Tell people what you're doing, how you're doing it and when you're doing it." This was the simple advice on sharing patient data that Dawn Monaghan, group manager of public services at the Information Commissioner's Office (ICO), gave healthcare practitioners, while speaking at a Westminster forum.

It might sound obvious, but it's exactly what the government failed to do with its initiative. There are plenty of benefits to synching up hospital and GP data, as was designed to, including bettering service, care and even drug delivery. Failing to clarify exactly what data would be made anonymous or pseudonymous, failing to tell the public who that data would be shared with and how, and failing to explain the entire process, was how the initiative fell short of realising its duty of care to the public at every stage. Because it was a legal failing, not just a PR one.

"Most of you have seen what happens when communication goes wrong," Monaghan continued. "You do not always have to ask people to share their data under the terms of Data Protection Act -- you do always have to tell them what you're doing."

The Data Protection Act should not be seen as a barrier to processing or sharing personal data, though, argued Monaghan. It just needs to be adequately followed, and under the law providers must ensure the "fair processing" of personal data, which generally equates to transparency. Whether medical data is being shared with the public or private sector, it's about proportionality, and demonstrating that.

Emma Stockwell, a partner at Hill Dickinson specialising in public health services, explained that consent does not have to be explicit, but can be implicit. The contract you make with a hospital physician while in their care allows for implicit consent, for instance, so that the doctor can ensure you get the best treatment.

"Most consent used for medical purposes is based on implicit consent," says Stockwell. "As long as patients are given appropriate information on the way it's used, stored and shared, they can be said to have implicit consent. Unless that patient opts out of that specific sharing."

For the purposes of things like, said professor Iain Carpenter, associate director of the Health and Informatics Unit at the Royal College of Physicians, when it comes to consent "for medical purposes", the latter is defined as "the sharing of information about ourselves given to receive care we need, in a way we'd like to receive it".

"It's the prime purpose of the whole thing. For secondary research, for instance, it's extremely useful to know where are people are getting breast cancer treatments and where it's costing more." He added that this kind of data sharing would be vital to taking advantage of things like genome sequencing to deliver tailored medical care. "To make that cost that worthwhile we need a lot of information about people and their healthcare. The purpose is to make sure there is available high quality, reliable clinical information in a standardised form."

"It all boils down to the appropriate delivery of information to patients, and the ways in which information is shared and used," though, adds Stockwell.

Under the terms of the Caldicott Report -- which lays out how medical professionals should deal with confidentiality issues, while always ultimately abiding by the Data Protection Act -- every healthcare professional must justify the purpose of using patient data, they must not use patient-identifiable data unless absolutely necessary, use the minimum patient-identifiable data and always ensure that info is on a strict need to know basis.

"Under the report, you should always start from the premise of, 'can we get the required outcome for the patient by sharing that data'," said ICO's Monaghan. "What are the internal drivers? What would be the outcome without sharing personal data? Always start at the anonymised 'green data' and work your way to red data, rather than starting at red and then considering whether we needed to share it or not in the first place.

"When it comes to fair processing, people need to know what you're doing with their data, why, for how long and whether they have an option to opt out."

Someone that visits their doctor regularly, she pointed out, might have more awareness of these options. Most would not. The facts need to be made clear for that section of society, with prominent online notices on service websites. "And make sure it's a website your citizens use, not only your patients." fell short on almost all of the necessary steps cited here.


Latest on