In the last five years, more scientific data has been generated than in the entire history of mankind
On 22 June 2021, the Department of Health and Social Care (DHSC) published its draft policy paper titled 'Data Saves Lives, reshaping health and social care with data'. Setting out ambitious plans to harness the potential of data in health and care, the ambitious strategy focuses on the benefits of digitisation of the NHS and other care authorities, while maintaining the highest standards of data protection and ethics. The coronavirus pandemic has accelerated the digitisation of the health and social care system and the paper aims to provide a blueprint for the government's future plans. However, the implementation of the UK General Data Protection Regulation (UK GDPR) means that new uses and sharing of health data require strict legal foundations ingrained in the principles of lawfulness, fairness and transparency, purpose limitation, security, integrity and confidentiality. Clearly, the views of healthcare professionals and the public are evolving when contemplating the potential benefits for research and medical science of big data analytics in AI in harvesting health data.
The publication of the draft strategy policy comes in the wake of a general backlash against the controversial General Practice Data for Planning and Research (GPDPR) programme, purporting to transfer all GP records into a centralised database, a plan now expected to be postponed to 1 September 2021.The draft strategy has three key priorities:
- educate on the ways data may be used for health and care purposes, to foster innovation, and the importance of ensuring transparency to win trust from health and care users;
- establish new data sharing policies across the whole a health and care system; and
- support the new strategy with the appropriate legal, technical and governance framework.
The draft strategy also commits the DHSC to, where appropriate, act on the findings and recommendations of the Goldacre Review [1] into the use of data for research and analysis which is expected to conclude later on this year.
The final version of the strategy is expected to be published later in 2021. In the meantime, the government has launched a consultation of stakeholders.
What does the draft policy cover?
The new strategy proposes central improvements to the way the data collected by the NHS (and other care providers) in England is used. The paper is split into 7 chapters each tackling a separate way in which patient data may be used to benefit the health and social care system and ensure a high quality of care.
Chapter One - Bringing People Closer to Their Data
The first aim is to make patient data easily accessible to patients themselves. The policy outlines that a person accessing social or health care should have digital access to their health and care information, including test results, procedures and care plans and access to a system to manage appointments. More interestingly, the plans also include facilities for individuals to share additional data including sleep pattern, food and exercise with their care providers.
The policy also notes the importance of increased transparency about how the health and care system protects and uses the data provided – although this is not expanded upon within the policy itself.
The policy aims to bring patient data from across numerous sources (e.g. GP's systems, Emergency Departments, personal wearable devices) into one singular data store which can be accessed by any section of the health and care system – including the patient themselves.
This data provided would then be used, in line with the policy's wider aims, to improve patient care and also help forecast for future needs of the NHS.
Chapter 2 – Giving Health and Care Professionals the Data they need to provide the Best Possible Care
The new policy aims to give staff quick and easy access to information about people under their care to support the decision making process. The recording of this data in a central location is aimed to save time and reduce the data collection burden for practitioners in taking a patient history every time a patient is seen. Health care practitioners are expected to have confidence, through the digitisation, in sharing data between points of care even when this involves sharing data across NHS trusts.
The policy also suggests a strengthening of the duty to share data for the purposes of individual care originally introduced under S251B of the Health and Social Care Act 2012. This new duty on health and care organisations will be to share anonymous data "across the health and social care system".
In addition, a new shared Care Records system will be in place by 2024. This system aim is to make it possible for staff that use different data systems or record their data in different ways to see an individual's personal history and information in one shared location.
Chapter 3 – Supporting Local and National Decision Makers with Data
This section envisages providing data around current service delivery and local population to ensure proper planning and management on a local authority and national level. The GPDPR programme is one arm of this policy, mentioned earlier and discussed in our separate article.
The aim of these measures is to allow decision makers to review and analyse the impact on health and social care going forward.
In addition, it is proposed that all source code created through the project will be open and reusable to all analysts.
However, some proposed use of the government's legislative powers to weaken the long trusted principle of doctor–patient confidentiality, is of concern when it states: "we will use secondary legislation in due course to enable the proportionate sharing of data including, where appropriate, personal information for the purposes of supporting the health and care system without breaching the common law duty of confidentiality".
Chapter 4 – Improving Data for Adult Social Care
Similar to Chapter 1 this means that people in adult social care should have access to their own data and will have the ability to share this data with people supporting them including family and friends. The data will be shared with care providers linking client level data from local authorities and health data.
The draft paper also proposes that local authorities and Jobcentre Plus should share data with adult social care services (and vice versa) to ensure that health, employment and access to community support is integrated.
Chapter 5 and 7 - Empowering Researchers / Developers and Innovators
These two chapters handle the use of patient data to further scientific research and improve the level of care provided. The policy looks to promote open code, and will publish a digital playbook on how to make code available on an open source basis for health care organisations. The government wish to encourage AI innovation and collaboration with the wider tech sector.
Chapter 6 – Helping Colleagues Develop the Right Technical Infrastructure
This final section aims to modernise the IT structures that support collected data and publish outlines regarding how data will be stored, shared and sent between organisations. A new power for the Secretary of State for Health and Social Care will be introduced which will enable the Secretary of State to mandate data collection and storage standards.
Priority is also given to developing a long term plan to manage evolving cyber security threats. This is intended to include a set of recognised standards to be published and continued support to be provided for data architecture to be drill tested and national incident response plans to be regularly rehearsed.
What are the key data protection risks?
The draft paper emphasises that none of the proposed changes will remove the duties of organisations to meet the requirements of applicable data protection legislation. All uses of an individual’s data will need to be necessary, proportionate, transparent and subject to that individual’s rights to access, correction and information on use. The strategy promotes a new obligation to share anonymous data across the health system securely, including with commercial organisations, subject to new specific consistent standards applying to the compilation, storage and sharing of data. Such data sharing may however not always be anonymous data, it may also be pseudonymous data or even personal data. In such cases, what are the privacy implications with respect to transparency and security?
Key takeaways
The NHS and DHSC carry the burden of a two decade-long legacy of failed IT programmes including its “expensive and largely unsuccessful” [2] previous attempt, between 2002 and 2011, at introducing an integrated IT system with patient records available electronically.
With the NHS's original 2018 target for a paperless records system having been missed and moved back by six years it remains to be seen whether the admirable aims of the draft paper will be achievable in practice.
The pandemic has accelerated the digitisation of healthcare and has shown that when done correctly datasets can be vital in ensuring good community health. Continuing to make NHS data available for research, securely and appropriately, is vital to empower scientific advances that will transform people's lives.
The Data Saves Lives policy paper provides a mere outline of the direction that the UK government is heading to rather than providing detailed provision on the data protection issues at hand.
[1] The Goldacre Review was launched in February 2021 to focus on the efficient and safe use of health data for research and analysis for the benefit of patients and the healthcare sector. It is being undertaken by Dr Ben Goldacre, Director of the DataLab, Nuffield Department of Primary Care Health Sciences, University of Oxford.
[2] The Public Accounts Committee's 2020 report "Digital transformation in the NHS" notes that the despite publishing its Vision for digital, data and technology in 2018, the DHSC still does not have an implementation plan for how this will be delivered in practice.
Co-Written by Jennifer Donaldson