Concerns over England's new system for collecting general practitioner data
Authors: Talha Burki
Journal: The Lancet Digital Health (2021)

On Sept 1, 2021, England will roll out a new system for collecting patient data from medical records held by general practitioners (GPs). The new General Practice Data for Planning and Research (GPDPR) expands on the outgoing General Practice Extraction Service. Patient data will continue to be shared with NHS Digital but will be used for a broader range of purposes. These include planning and commissioning health-care services, monitoring public health, and enabling research. Organisations, including commercial entities, that satisfy strict conditions can be granted access to the de-identified data. But not everyone is satisfied with the way in which the GPDPR is being introduced. The rollout of the GPDPR has been postponed after organisations such as the British Medical Association (BMA) and the Royal College of General Practitioners (RCGP) raised concerns that the government had neglected to inform the general public how their data will be collected and used. On June 4, the BMA warned that “rushing through such fundamental changes to confidential healthcare data, losing the confidence of the public and the profession, will severely undermine the programme and threaten any potential benefits it can bring to healthcare planning and research”. The current plan is for GP data for the past 10 years to be extracted and shared with NHS Digital from Sept 1. The data will include information on diagnoses, symptoms, test results, and sexual, physical, and mental health. NHS Digital will also gather information on sex, ethnicity, and sexual orientation. Names and addresses will not be collected, nor will written notes—eg, those detailing conversations between patients and medical staff. A spokesperson for NHS Digital told The Lancet Digital Health that the new service would be “more efficient and cheaper, with enhanced privacy protections for the data in transit and reduced burden on practices”. Data will be collected on a daily basis, to permit policy makers to track changes in real time. Data will be de-personalised, although NHS Digital will retain the ability to re-identify patients in specific circumstances—eg, when an individual has consented to be part of a clinical trial. Researchers can apply for access to data held by NHS Digital. Applications are initially reviewed by NHS Digital, and subsequently by the Independent Group Advising on the Release of Data. For GP data, there is an additional review by the GP Professional Advisory Group, which includes representatives from the BMA and RCGP. Commercial organisations will not be debarred from accessing GP data, although they will have to demonstrate that their work will benefit patients in England and Wales. NHS Digital charges for access to data, in order to cover the cost of running the services. “For many years, health data from hospitals, death certificates, and cancer registries have been used for research and to improve health care. It would be strange if a health-care system did not look at GP data”, said Martin Landray, professor of medicine and epidemiology at the University of Oxford. “It is indispensable for all kinds of research: if we want to know who is most at risk of a fall, heart attack, or stroke, or we want to identify variations in care, or monitor treatments to make sure that patients are not experiencing any unwanted effects.” The NHS does not have the capacity to conduct this kind of research itself, nor is it in a position to run clinical trials, so it makes sense to grant academic researchers and pharmaceutical companies access to patient data. Landray is co-lead for the RECOVERY trial, which has studied a range of potential therapies for COVID-19 and identified dexamethasone as an effective treatment. RECOVERY mostly uses hospital data, but it used GP records for information on patients' ethnicity. “This information was already in the system, it just happened to be most complete in the GP records”, explains Landray. “By linking to these data, we could work out the ethnic mix of the people in the trial without having to quiz seriously ill patients as they came into the hospital.” Defining the burden of so-called long COVID, and whether any of the treatments trialled in RECOVERY alleviate the chances of developing the condition, will rely heavily on data from GPs. “In principle, improved and more secure sharing of data for health-care planning and research purposes is a good thing”, agrees Martin Marshall, chair of the RCGP. “We have seen during the COVID-19 pandemic just how important the appropriate use of GP patient data is in responding to a health crisis, but it is also important in normal times to plan for better service provision and public health strategies.” Marshall stresses the importance of ensuring that patient data are kept secure. NHS Digital has in place a series of precautions, including thorough vetting of those who apply to obtain data, and auditing of successful applicants to confirm that they are using the data as agreed and that the stipulated benefits of their research are being realised. Insurance companies and marketers are denied access to patient data. “Users will only be able to access data in the system through a trusted research environment”, stated the NHS Digital spokesperson. “The data will only be accessed for health and care planning and research purposes by organisations that have a legal basis and legitimate need to use the data. We publish the details of the data we share on our data release register so we can be held to account.” Still, if there was a security breach, the government could come to regret centralising so much data. Moreover, researchers have repeatedly demonstrated the ease with which individuals can be re-identified from de-personalised data of the kind proposed for the GPDPR. “There have been plenty of cases where de-identified medical data were subsequently re-identified from basic demographic information”, said Luc Rocher, a postdoctoral researcher in the Data Science Institute and the Computer Privacy Group at Imperial College London. The GPDPR will include patients' year and week of birth as well as their postal district, gender, and ethnicity. Rocher's group has previously shown that similar demographic information could be used to identify an individual with high certainty. “People might assume de-personalised means anonymous. But anonymity is legally well defined in Europe. These data should still be treated as personal data”, points out Rocher. “Under the GPDPR, there is the potential for widely sharing very sensitive patient data, which could mean a greater chance of re-identification.” Individuals who are part of under-represented groups are particularly vulnerable to re-identification, because of their relative scarcity. Landray agrees that it might not be possible to eliminate the risk of re-identification; however, it is possible to establish deterrents. “We are talking about a breach of contract and quite possibly a criminal offence”, Landray told The Lancet Digital Health. “The control measures for obtaining patient data are rigorous—you have to describe the purpose of your work, what data you need and why you need it, and what measures you are taking to maintain its security. All this is bound into a contractual agreement.” If a clinical researcher was caught re-identifying patients without permission, their organisation would face a hefty fine, and the individual would face disciplinary action from their employer and professional bodies such as the General Medical Council. “That is an incredibly strong deterrent”, said Landray. “There are a lot of things that you cannot absolutely prevent from happening. But what you can do is set standards for good practice, introduce sturdy safeguards, and impose very strong penalties for those who violate the rules.” Given the intricacies of the technical issues and privacy concerns associated with the GPDPR, it is perhaps surprising that the major criticism NHS Digital has faced is over its communication strategy. “Unclear messaging and a complete failure to develop a wide ranging and far-reaching public engagement plan to communicate with the population, has resulted in a completely unrealistic expectation that GPs are left to communicate these complex changes”, complained the BMA, in its statement of June 4. Health minister Jo Churchill has stated that the additional time gained by postponing the introduction of the GPDPR would be used to “talk to patients, doctors, health charities, and others to strengthen the plan, build a trusted research environment, and ensure that data is accessed securely”. The delay was welcomed by Marshall. But he is worried that the government is still failing to communicate. “It is concerning that details of the public information campaign are yet to emerge”, said Marshall. “If the programme is to be in a position to commence on Sept 1, the government and NHS Digital must act swiftly to engage with the public, build trust, and ensure patients have the opportunity to make informed choices about the use of their data.” Patients are automatically opted in to the GPDPR, but they can choose to opt out, either by specifying that their data not be shared outside their GP practice or that their data not be shared beyond NHS Digital. A petition to shift to an opt-in model has been signed by almost 240 000 people. Marshall urges the government to run a comprehensive information campaign, getting in touch with each patient individually, articulating the benefits and risks of data sharing, and outlining the provisions for opting out. Time is running short: as things stand, those who opt out after the GPDPR has started running will not have their data retrospectively deleted.