You may know that patients and the public have been benefitting from research using health care data for quite some time. But like me, have you only just recently learned how much the rules about protecting confidential patient information have changed in light of the COVID-19 pandemic? Or perhaps you are not aware of this at all? As a member of the HDR UK Public Advisory Board and a patient currently receiving NHS care, I would like to share my thoughts on this and how organisations can work with patient groups to increase transparency and build public trust.
So what has changed? Existing privacy-related regulations for control of patient information (COPI) were changed under the COVID-19 Public Health Directions 2020 in mid March. COPI notices were served to NHS Digital, GP practices and other organisations providing health care as well as Local Authorities and “Arms-length Bodies of the Department of Health and Social Care” (e.g. Public Health England). These legal notices ordered NHS Digital to collect and analyse health care information for the duration of the coronavirus emergency period. Patient information is to be used only “for the purposes of informing health services planning and supporting vital research on the cause, effects, treatment and outcomes for patients with the virus.” COPI notices ordered GPs and the other organisations to share patient data, including patient-identifiable information, with NHS Digital and for GP practices to provide information from their care records to UK Biobank. These COPI notices will be reviewed (and possibly extended) but are currently in force until 30 September 2020 whilst the COVID-19 Public Health Directions are in place until 31 March 2022 (unless they are revoked or replaced in their six-monthly reviews).
Whilst many of us know that emergency powers were passed soon after the pandemic reached the UK (e.g. greater police powers), I certainly wasn’t aware that these powers changed considerably how private patient information is to be shared. So what is different? Firstly, prior to COVID-19, your GP practice could choose whether or not they provided information (primarily anonymous) from their patients’ records when NHS England teams requested them. Following the COVID-19 Directions, GPs are now legally obligated to share information for purposes related to the coronavirus emergency. Another important difference relates to patient consent for care information to be used for reasons other than providing direct patient care. If you were one of the many patients who took advantage of the national opportunity to ‘opt-out’ of sharing their care data, you may be surprised to learn that your blanket withholding of consent does not currently apply.
Last month NHS Digital shared an online transparency notice about using information from patient GP records. Following this, GP practices updated their transparency notices on their websites to include the new arrangements for data sharing (which includes patient-identifiable information and without patient consent) required under COPI notices. NHS Digital has also produced a ‘template general practice notice’, which GPs can use to inform their patient populations.
As a patient advisor to HDR UK, I have seen how they are helping to make essential COVID-19 research using data across the UK and internationally possible. Each week, members of the COVID-19 Patient and Public Involvement and Engagement (PPIE) Group and the Public Advisory Board have participated in deciding which research questions are most important and urgent and more recently have contributed to HDR UK’s report to SAGE.
Very recently, NHS Digital expressed an interest to work with HDR UK’s COVID-19 (PPIE) Group to find out their views on GP data being used for COVID-19 related research and, particularly, have asked for feedback on their transparency notice. Members of both the COVID-19 PPIE Group and the Public Advisory Board have read and responded to specific questions (e.g. about its suitability and ease of understanding). Some very good points are being raised and we can start to see some common themes in the feedback. On a personal note, the opening sentence of the transparency notice could be a problem: “This practice is supporting vital coronavirus (COVID-19) planning and research by sharing your data with NHS Digital.” It comes across to me as if GP practices are voluntarily sharing patient information rather than being legally required to do so. It’s in areas such as these in which our feedback can help improve communication and transparency.
I am pleased to see NHS Digital reaching out for patient and public input to this work and to ensure that information about these important changes in how our health data are used can be made more transparent. There are clearly still areas that are lacking in transparency – perhaps a future blog could explore these issues?
