Barclays Details Leaked

[tomandlu]

Easily done, if the original paper records have been destroyed just print the digital records before deleting them.

As for clinical problems, surely it's up to the individual to weigh up any clinical risks.

Sorry, missed this. Part of the problem is that I doubt there's an effective record of all the systems that hold clinical data.

Moving beyond that, on a clerical level, they just wouldn't know how to admit you without a PAS record at the very least. Then you have the lab systems who need to send chemistry results to a meaningful record (often duplicated across several systems).

I guess you could argue for the option of opting out and not getting NHS treatment at all, but arguing for the option of being allowed to cause chaos seems an odd one...

Edit to add, just read Chumpus's reply, which makes mine rather redundant...

Edited February 10, 2014 by tomandlu

[Bruce Banner]

Sorry, missed this. Part of the problem is that I doubt there's an effective record of all the systems that hold clinical data.

Moving beyond that, on a clerical level, they just wouldn't know how to admit you without a PAS record at the very least. Then you have the lab systems who need to send chemistry results to a meaningful record (often duplicated across several systems).

I guess you could argue for the option of opting out and not getting NHS treatment at all, but arguing for the option of being allowed to cause chaos seems an odd one...

Edit to add, just read Chumpus's reply, which makes mine rather redundant...

Now that is worrying.

[tomandlu]

Now that is worrying.

To put it in context, old databases may be kept available "just in case" during an upgrade and subsequent go-live, and then effectively forgotten about. In addition, a surprising number of doctors and consultants are amateur programmers, and tend to build 'helper' applications to aid either their own research or the general workflows of their clinical units.

Beyond that, trusts vary hugely in terms of compliance with data-protection laws, and in terms of the training given to staff in this area.

TBH I'd be less worried by sharing of clinical data amongst clinical professionals, who are, after all, primarily concerned with delivering the best clinical care they can, and more concerned with the commercialisation of the data (http://www.care-data.info/).

I have to admit, I'm a little vague on exactly what got nicked from Barkers - was this their data? (i.e. collected from questionnaires provided by them), or had they acquired confidential NHS clinical data without the permission of the customer? The latter would be both odd and very worrying.

[Bruce Banner]

To put it in context, old databases may be kept available "just in case" during an upgrade and subsequent go-live, and then effectively forgotten about. In addition, a surprising number of doctors and consultants are amateur programmers, and tend to build 'helper' applications to aid either their own research or the general workflows of their clinical units.

Beyond that, trusts vary hugely in terms of compliance with data-protection laws, and in terms of the training given to staff in this area.

TBH I'd be less worried by sharing of clinical data amongst clinical professionals, who are, after all, primarily concerned with delivering the best clinical care they can, and more concerned with the commercialisation of the data (http://www.care-data.info/).

I have to admit, I'm a little vague on exactly what got nicked from Barkers - was this their data? (i.e. collected from questionnaires provided by them), or had they acquired confidential NHS clinical data without the permission of the customer? The latter would be both odd and very worrying.

Surely the writing of 'helper' applications, to manipulate our data, by individuals, contravenes the data protection act.

It is not the present, intended, use of the data that concerns me, it is unintended or future use. What if the government, or a future government, decided to make all of our medical records available to the US immigration authorities, as they have done, I believe, with the criminal records database.

In this case it would seem that the stolen data was collected by Barclays themselves from customer questionnaires, but it is a wakeup call.

[tomandlu]

Surely the writing of 'helper' applications, to manipulate our data, by individuals, contravenes the data protection act.

Doubt it - and the programmers in question will almost certainly have discussed the issue with their trust's Caldicott representative.

It is not the present, intended, use of the data that concerns me, it is unintended or future use. What if the government, or a future government, decided make all of our medical records available to the US immigration authorities, as they have done, I believe, with the criminal records database.

Well, quite - which makes the format (paper, digital) somewhat irrelevant.

In this case it would seem that the stolen data was collected by Barclays themselves from customer questionnaires, but it is a wakeup call.

In some ways, that's a shame. It would have been quite a wake-up call.

BTW I do suggest you follow the link I gave earlier. Your fears are not unfounded... http://www.care-data.info/

[Bruce Banner]

Doubt it - and the programmers in question will almost certainly have discussed the issue with their trust's Caldicott representative.

Well, quite - which makes the format (paper, digital) somewhat irrelevant.

In some ways, that's a shame. It would have been quite a wake-up call.

BTW I do suggest you follow the link I gave earlier. Your fears are not unfounded... http://www.care-data.info/

Sending container loads of paper records to the US authorities would be difficult to collate at both ends.

At least we can, theoretically, opt out of care data.

[tomandlu]

With regards to care.data, I thought you might be interested in this bit of an internal email in our company:

what makes no sense to me is that as a company engaged in providing clinical data systems to the NHS, obtaining basic datasets such as GMC Numbers and practice codes (i.e. useful administrative data but not sensitive or personal information) involves us going through a process of applying for access permission and making an undertaking that we will not divulge the data to any third parties, make commercial use of it, only use it in support of NHS operations, secure it against theft and accidental loss, etc. etc.) but now the government is happy to hand over highly sensitive and confidential patient data via a commercial organisation, care.data, and to allow anyone, who can make a reasonable case that the data is useful to them, to access it without any of the caveats mentioned at the start of this (very long) sentence to something as basic as a list of practice codes.

The very fact that yet another organisation has been set up for this when we already have NHS TRUS, CUI, CfH, HSCIC, and several others that I can't remember off the top of my head, seems a little odd. Not least because, being Atos, this is a commercial operation that, presumably, is supposed to be self funding. So the bottom line is, regardless of whether the data is being used for good or bad, it is being sold so that Atos can make money. At this point I dig my heels in - I just don't think it's the right way to do it.

On the one hand we are constantly being warned by our NHS customers about the sensitivity and confidentiality of the data we have access to, to the extent that even thoroughly anonymised data is still very sensitive (e.g. it's potentially possible to identify patients via rare medical conditions), and yet the government is proposing to give it to (more, or less) anyone who wants it. I know there are restrictions on who can get the data but the bar seems to be set a lot lower that it should be and the very nature of the programme (to make this data more widely available) is almost certainly going to result in confidential patient data escaping into the wild.

Anyone want to make a bet on how long it'll take before we have a front page scandal involving care.data ?

[happy_renting]

BTW I do suggest you follow the link I gave earlier. Your fears are not unfounded... http://www.care-data.info/

Thanks for that. I read it an hour ago, and within 30 minutes I handed in a completed opt-out letter/form at my surgery.

[tomandlu]

Thanks for that. I read it an hour ago, and within 30 minutes I handed in a completed opt-out letter/form at my surgery.

I'm in the slightly odd position of having volunteered for full-disclosure of my medical history and records for research and 'related' purposes a few years back now...