Rushed Electronic Health Record Scheme A Threat To Privacy

Everyone should have revived a a letter this month from their local Primary Care Trust explaining that their personal health information will soon be stored electronically in a 'Summary Care Record' (SCR), which will be available to 'authorised' NHS staff.

If GP practices have not heard objections from patients by the end of June, NHS Trusts intend to assume that individuals have provided implied consent for the creation of these care records over the next 18 months. However, the British Medical Association has warned that patients' rights are being ignored and that Connecting for Health, the NHS bureaucracy running the scheme, has made it as difficult as possible for patients to opt out.

Those who have actually opened their letter (itself a concern, as seven out of ten patients in the pilot areas for the scheme were unaware that an SCR was created for them and some patients have been sent other patients’ letters) will have discovered that there is no opt-out form. Connecting for Health has refused to make this a national requirement and instead, patients have to go out of their way to either ring a helpline to order one or download a copy from a website. GPs are unable to order bulk copies.

Why worry about this? Because although the initial records will be fairly simple, they inevitably will include more and more highly confidential health information in the future, including prescription details (for anti-retro-viral or psychotropic drugs, for instance) that could be potentially stigmatising if they fell into the wrong hands and the probable inclusion, considering government enthusiasm for databases, of personal DNA data.

There are huge privacy concerns about the sensitivity of the details that will be held on each of us and with tens of thousands of NHS staff having a swipe card to enter the system, any promises that information would never be passed on to other state agencies, leaked to unscrupulous tabloid journalists or examined by curious medical staff (as has happened in Scotland) simply lack credibility. They are about as believable as NHS claims that an SCR will “provide more effective care” in an emergency – having recently been a patient at the Royal London Hospital's Accident and Emergency department, where I was recorded as an unknown male of no fixed abode and given the name of a large Canadian province for a surname (despite plenty of identification in my wallet), I know that there’s no guarantee doctors will always identify emergency admissions accurately.

So rigid is the bureaucracy behind the SCR scheme that simply telling your GP that you want to opt out doesn't seem to work – my doctor insists that I have to provide a completed form, even though I explicitly expressed my dissent three years ago. Having discovered the NHS Confidentiality campaign's Big Opt Out website in 2007, I wrote to my GP insisting that his computer records includes the code “9C3C – Refused consent to upload to national shared database.” But that apparently is not enough and I now feel I have little choice but to write and warn my doctor that he will have breached the Data Protection Act if a Summary Care Record is created in my name using details he provides.

This is what happens when governments with little discernible interest in privacy and civil liberties ploughs ahead with rushed IT projects. Sadly, with an election approaching and the media more concerned with how fragrant the party leaders' wives are, millions of people may not even notice that a severe threat to the confidentiality of their health records has been introduced on the sly.