Warning over privacy of 50m patient files in the UK

The Guardian is running a deeply critical article on the new electronic health records system being rolled out in the UK, called The Spine:

Warning over privacy of 50m patient files Health SocietyGuardian.co.uk:

... And a Guardian inquiry has found a lack of safeguards against access to the records once they are on the Spine, the computer designed to collect details automatically from doctors and hospitals. The NHS initiative is the world's biggest civilian IT project. In the scheme, each person's cradle-to-grave medical records no longer remain in the confidential custody of their GP practice. Instead, up to 50m medical summaries will be loaded on the Spine.

The health department's IT agency has made it clear that the public will not be able to object to information being loaded on to the database: "Patients will have data uploaded ... Patients do not have the right to say the information cannot be held."

Once the data is uploaded, the onus is on patients to speak out if they do not want their records seen by other people. If they do object, an on-screen "flag" will be added to their records. But any objection can be overridden "in the public interest".

Harry Cayton, a key ministerial adviser, warned last month of "considerable pressure to obtain access to [the] data from ... police and immigration services", but he is confident that these demands can be resisted by his department.

Another concern is the number of people who can view the data. The health department has issued 250,000 pin-coded smart cards to NHS staff. These will grant varied access from more than 30,000 terminals - greater access for medical staff, and less for receptionists. Health managers, council social workers, private medical firms, ambulance staff, and commercial researchers will also be able to see varying levels of information. Officials say the data will be shared only on a need-to-know basis. But Guardian inquiries show a lack of safeguards.

Although data protection laws supposedly ban unnecessary build-ups of computer information, patients will get no right to choose whether their history is put on the Spine. Once uploading has taken place, a government PR blitz will follow. This will be said to bring about "implied consent" to allow others view the data. Those objecting will be told that their medical care could suffer....