Re: Slow and costly access to anonymised patient data impedes academic research
Research is vital, and it is always unfortunate when any research project fails to deliver the promise in the funding proposal, irrespective of the reason. But railing against the custodian of the nation’s medical histories, the HSCIC, seems an odd choice if given any consideration.
The author’s institution was unable to give the assurances required that they were capable of looking after the data to the standard that the public expects. The standards have barely changed; what’s changed is that HSCIC has started checking the assurances more carefully – something it should have been doing all along.
Those necessary assurances are steered and delivered by institutions and supervisors on behalf of their students, not individual students themselves. It is not the students’ fault if their institution refuses to assure that it will take due care of 1 billion health events. And it is precisely the lack of verification of such assurances that sent 25 years of medical records to insurers, to marketers, and elsewhere.
Academia emerged with its reputation pretty much unscathed from the data debacles of 2014 and 2015. The high standards legitimate institutions expect of their researchers are one of the factors that justify the access to sensitive medical data, sometimes without consent, that academia is in a position to receive. Complaining that the standards are too high for your institution to agree to meet says more about the institution than the standards.
All research is important, but no single project – and no one institution – is more important than public confidence in all research. That is why a wide range of organisations support the “one strike” principle for abuse or misuse of medical records. With the Hospital Episode Statistics, i.e. linked, longitudinal medical records of the population for the past 30 years, every woman with 3 children is uniquely identifiable – and with 2 children that’s about 90% likely (quite literally, a birthday attack).
In the last week, the ICO has fined the UK’s largest internet pharmacy for selling NHS patient and customer details to spammers, quacks and charlatans, pushing “innovative treatments” and lottery scams. Those participating in the abuse of these records stand to make a great deal of money, and until there is a ban on marketing to patients that leads to jail time for these predators, there will continue to have to be deep scrutiny of every project, and every release.
The “promotion of health”, as undefined in the Care Act 2014, is a loophole so broad you could slip a Saatchi advertising hoarding through it, quacking.
The author’s experience is unfortunate. Both the researcher and their funder deserve a clear answer as to why their institution doesn’t provide them the infrastructure necessary for modern data-driven health research. But corners cannot be cut if patient confidence is to be maintained.
The care.data debacle includes lessons for many., While BMJ readers would always uphold the highest standards of Information Governance, readers may consider (former) colleagues who might – in similar or related circumstances – find themselves with a highly-cited paper, for all the wrong reasons?
HSCIC is the custodian of the nation’s medical histories. In making it available for legitimate research, it simply requires you fill in a form honestly. That shouldn’t be too high a bar.
Competing interests:
Phil Booth coordinates medConfidential which advocates for consensual, safe and transparent use of medical records. medConfidential sat on the care.data Advisory Group from its inception in March 2014 to its abolition in October 2015.
Rapid Response:
Re: Slow and costly access to anonymised patient data impedes academic research
Research is vital, and it is always unfortunate when any research project fails to deliver the promise in the funding proposal, irrespective of the reason. But railing against the custodian of the nation’s medical histories, the HSCIC, seems an odd choice if given any consideration.
The author’s institution was unable to give the assurances required that they were capable of looking after the data to the standard that the public expects. The standards have barely changed; what’s changed is that HSCIC has started checking the assurances more carefully – something it should have been doing all along.
Those necessary assurances are steered and delivered by institutions and supervisors on behalf of their students, not individual students themselves. It is not the students’ fault if their institution refuses to assure that it will take due care of 1 billion health events. And it is precisely the lack of verification of such assurances that sent 25 years of medical records to insurers, to marketers, and elsewhere.
Academia emerged with its reputation pretty much unscathed from the data debacles of 2014 and 2015. The high standards legitimate institutions expect of their researchers are one of the factors that justify the access to sensitive medical data, sometimes without consent, that academia is in a position to receive. Complaining that the standards are too high for your institution to agree to meet says more about the institution than the standards.
All research is important, but no single project – and no one institution – is more important than public confidence in all research. That is why a wide range of organisations support the “one strike” principle for abuse or misuse of medical records. With the Hospital Episode Statistics, i.e. linked, longitudinal medical records of the population for the past 30 years, every woman with 3 children is uniquely identifiable – and with 2 children that’s about 90% likely (quite literally, a birthday attack).
In the last week, the ICO has fined the UK’s largest internet pharmacy for selling NHS patient and customer details to spammers, quacks and charlatans, pushing “innovative treatments” and lottery scams. Those participating in the abuse of these records stand to make a great deal of money, and until there is a ban on marketing to patients that leads to jail time for these predators, there will continue to have to be deep scrutiny of every project, and every release.
The “promotion of health”, as undefined in the Care Act 2014, is a loophole so broad you could slip a Saatchi advertising hoarding through it, quacking.
The author’s experience is unfortunate. Both the researcher and their funder deserve a clear answer as to why their institution doesn’t provide them the infrastructure necessary for modern data-driven health research. But corners cannot be cut if patient confidence is to be maintained.
The care.data debacle includes lessons for many., While BMJ readers would always uphold the highest standards of Information Governance, readers may consider (former) colleagues who might – in similar or related circumstances – find themselves with a highly-cited paper, for all the wrong reasons?
HSCIC is the custodian of the nation’s medical histories. In making it available for legitimate research, it simply requires you fill in a form honestly. That shouldn’t be too high a bar.
[1] BMJ 2015;351:h5087
[2] HSCIC Data Access and Request Service dashboard. http://www.hscic.gov.uk/dars-dashboard
[3] HSCIC. Review of data releases made by the NHS Information Centre. June 2014. https://www.gov.uk/government/publications/review-of-data-releases-made-...
[4] HC Deb, 10 March 2014, c136 http://www.theyworkforyou.com/debates/?id=2014-03-10a.132.0&s=%22one+str...
[5] HSCIC. Hospital Episode Statistics (Inpatient) Data Dictionary. http://www.hscic.gov.uk/media/1358/HES-Hospital-Episode-Statistics-HES-A...
[6] Information Commissioner. Action we've taken - Enforcement : Pharmacy2U Ltd. 20 October 2015. https://ico.org.uk/action-weve-taken/enforcement/pharmacy2u-ltd/
[7] “innovative treatments” are defined in: http://www.publications.parliament.uk/pa/bills/cbill/2015-2016/0008/cbil...
[8] ibid 6. Paragraphs 49, 51, 52
[9] Care Act 2014. http://www.legislation.gov.uk/ukpga/2014/23/section/122/enacted
[10] Sterckx S, Rakic V, Cockbain J, Borry P “You hoped we would sleep walk into accepting the collection of our data”: controversies surrounding the UK care.data scheme and their wider relevance for biomedical research. Medicine, Health Care and Philosophy. August 2015. http://link.springer.com/article/10.1007%2Fs11019-015-9661-6 doi:10.1007/s11019-015-9661-6
[11] Presser L, Hruskova M, Rowbottom H, Kancir J. Care.data and access to UK health records: patient privacy and public trust. Technology Science. 2015081103. August 11, 2015. http://techscience.org/a/2015081103
[12] ibid 6. Paragraph 62.
Competing interests: Phil Booth coordinates medConfidential which advocates for consensual, safe and transparent use of medical records. medConfidential sat on the care.data Advisory Group from its inception in March 2014 to its abolition in October 2015.