Friday, April 14, 2006

Please do not store my medical records in your leaky information systems

I have finally had time to reply to the NHS's stonewalling letter regarding their storage of personal information relating to my medical history.

Dear Mr Jordan,

Thank you for your letter of 2 February, which contained much useful information about the National Care Records Service. I will indeed be exercising the option you outline to prevent any of my personal information being held within the NCRS, whether or not the NHS feels that is "appropriate."

However, my concerns about the centralised storage of sensitive medical information by the NHS go much further than the NCRS, as do the NHS's information systems. I repeat my request from the letter I sent you last December (copy below): please acknowledge and confirm that the NHS will comply with that request.

Yours sincerely,

Ian Brown.

The Secretary of State for Health
Richmond House
79 Whitehall
London SW1A 2NL

I object strongly to my medical records being available to anyone except those who need them in order to provide me with medical care. I opt out of all other uses of them as far as I can, and I spell out the details in the following paragraphs.

I have noted the severe misgivings about NHS databases expressed at the national General Practitioners' conference (LMC 2005), and so I am exercising my opt-out rights - as Caroline Flint assured the House of Commons of the 16th June 2005 that I would be able to do.

Please instruct all data controllers within the NHS who may hold identifiable information about me that I am opting out of all secondary processing of my personal health information to the greatest extent permitted by law.

I consent to medical record information being stored and processed on computers that are under the direct control of the general practice with which I am registered, and that are located on the premises of that practice.

Where the NHS provides healthcare to me in any other setting, such as a hospital, I consent to information being stored and processed in computers which can only be accessed by staff directly employed in the same clinical setting. I also consent for relevant and necessary information to be sent electronically between a general practice with which I am registered and other providers for the purposes of my individual care, such as pathology reports and referral letters, when required and on request. This may include transmission by electronic means provided that the information is not stored or made available to any third party (including yourself) by the use of any intermediate or service computers.

Any access to my information shall only be made for the purposes of my own health care, and by staff of appropriate qualification and grade who access the information with my informed consent. My consent to information sharing may be treated as implied in respect of any clinician treating me, and in respect of staff under the direct supervision and control of that clinician (including secretaries and trainees), but may not be treated as implied in respect of any other person.

I do not consent to my data being held on computers which are accessible, physically or electronically, to workers elsewhere, even within the National Health Service. I specifically do not consent, and formally object, to the storage or processing of any health information identifying me on the Care Records Service, the NHS-Wide Clearing Service, or the Hospital Episode Statistics service. If you wish to keep any of my personal health information on record-keeping services provided to general practice by primary care trusts, then my express written consent must be sought. I do not consent to the processing of my personal health data by the Prescription Pricing Authority (PPA) database beyond that which is mandatory in law. I wish to place on record that I find all mandatory sharing of personal health information with persons not involved directly in my care - including the retention of PPA data beyond the period required for pharmacists to be paid - to be a distressing infringement of my rights.

Any previously provided, explicit, documented consent to the release of my personal health information for research purposes remains valid. Otherwise, my specific consent must be sought for all further processing of identifiable information in all other circumstances or where there is uncertainty.

I would regard any processing of my data outside of the terms of this instruction as "unfair" and "causing distress" in the terms of the Data Protection Act.

Will you kindly acknowledge that you have received this letter and that you will comply with my instructions.

Ian Brown

No comments: