I have finally received a response to the FIPR opt-out letter I sent to the Department of Health in early December. The letter asks the NHS to reduce the personal information held electronically about me to the minimum level permissible by law. The response below contains much useful information about the National Care Records Service, but does not provide any reassurance that the NHS will comply with my request. I will reply to ask again for that guarantee.
79 Whitehall London
Tel: 020 7210 3000
2 February 2006
Dear Mr Brown,
Thank you for your recent letter to Patricia Hewitt about the NHS Care Records Service (NCRS). As you can appreciate, Mrs Hewitt receives a large amount of correspondence and cannot respond to all of her mail personally. Your letter has been passed to me for reply and I apologise for the delay in responding.
There are many reasons why the NHS keeps records of the care and treatment it provides. Clinicians are required by their professional bodies to keep adequate records in recognition that review and audit of care is vital to patient safety and to maintaining and improving the quality of care. By law, lists must be kept of patients registered with each GP practice and a range of legal obligations require information to be shared for public health purposes. Details of the care provided to patients are also essential for ensuring the allocation of resources to cover the costs of care.
In the future, information about the care which patients receive will be recorded electronically, within the NCRS. The NCRS is a means of ensuring that the key details of a patient's care and treatment are held in an easily accessible, electronic format. The record - one for every patient in England - will have three levels: a Personal Demographic Record, a Detailed Care Record and a Summary Care Record. Initially it will store basic demographic details like their address, date of birth
and NHS number. Eventually, it will also record their health and care history. It will include information such as whether a patient is diabetic or has a drug allergy, as well as details of the treatment and care they have received, building up a comprehensive patient history.
In time, patients will be able to see their own record electronically, add personal information and preferences and point out errors. We believe that the NCRS will contribute enormously to improving the quality of the patient experience and of treatment and services.
People have a legal and moral right to expect that the clinical and personal information kept about them by the NHS will be complete, accurate and accessible to them, and that it will remain secure and confidential. The Department of Health has therefore ensured that the NCRS will incorporate the most stringent and up-to-date safeguards to protect confidentiality. Patients will have control over who, outside emergency situations; may see the Detailed Care Record or the Summary Care Record. If people feel that specific information about them is particularly sensitive and they do not wish even those who provide their care to have it, they will be able to place it in a 'patient's sealed envelope' so that it can be made available only with their express permission.
There will be stringent security and access controls. Only those staff who have a 'legitimate relationship' with the patient will be able to see a patient's record. Even with a legitimate relationship, a member of staff will have access only to those parts of the record that they need to do their job, known as 'role-based access control'. In addition, everyone who accesses a patient's record will leave behind a log of who they are, what they did, and when, and patients will have a right to see information from the log. This is in contrast to the present position with paper records, which can be easily inspected and copied without leaving any audit trail.
The Department recognises that a small number of people - doctors as well as patients - may still see the ease with which electronic records can be shared with other NHS staff as a threat to the confidentiality of their information. The Department takes concerns such as these very seriously. Indeed, one purpose in establishing the Care Record Development Board (CRDB), bringing together patients and service users, the public, and social and healthcare professionals within a single forum, was to take into account a wide range of views, about the values, principles and processes of care, but also the risks and difficulties in managing information. The CRDB provides advice to the programme about the ethical and policy implications of the introduction of the NCRS.
The Department will be launching an information campaign later this year to inform both NHS staff and patients all about the NCRS, its benefits and their rights and responsibilities as users of it. The campaign will focus on preparing the NHS to help patients understand the changes being introduced and the benefits of having an electronic health record. It will inform people about the changes and how their confidentiality will be protected, and will help patients to make informed choices about the levels of control they want to put on the sharing of their information.
On 23 May 2005, the Department published the NHS Care Record Guarantee for England. The Guarantee sets out the rules that will govern information held in the NCRS when it goes live next year. The Guarantee, which will be at the centre of the public information campaign, covers how records will be used, people's access to their own records, controls on others' access, how access will be monitored and policed, options people have to further limit access, access in an emergency, and what happens when someone cannot make decisions for themselves. The Guarantee can be found on the NHS Connecting for Health website, at: www.connectingforhealth.nhs.uk (enter 'guarantee' as a search term).
The Department has made it clear that NHS patients wishing not to have a record of their treatment held electronically within the NCRS will have that choice. It will be looking very closely at the circumstances where it may be appropriate for patients to exercise this choice in consultation with organisations representing the interests of patients, citizens and health professionals. The Department can also give an assurance that patients who choose not to have some or all of their records held electronically within the NCRS are at no risk of being 'de-registered' from the NHS or otherwise denied NHS care.
However, the Department does have serious reservations about the consequences of patients 'opting out'. There will be consequences for the patients themselves, since future care may have to be given (perhaps in a life-threatening emergency) in the absence of knowledge of existing conditions, earlier treatments and medications.
Inevitably, those who do make that choice may not receive the same quality of care as other patients. They will also lose the benefits that an electronic record will provide: greater convenience, easier shared participation in care decisions, and direct access to their personal health information. There may also be consequences for the NHS as a public service, such as increased costs when treating patients who have opted out of the NCRS, less robust healthcare statistics and financial flows, and constraints on the ability to quality assure and learn lessons from care provision and outcomes.
Finally, the NCRS will remain quite separate from the proposed National Identity Register. There will be no shared IT infrastructure. There is no question of unauthorised people accessing individuals' electronic care records via ID cards.
I hope that this information is helpful,
Customer Service Centre
Department of Health