Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NHS is selling your private data – here's the price list [pdf]

hscic.gov.uk

Post reply on HN
Print view View original

111–120 of 122 posts

Re: The NHS is selling your private data – here's the price list [pdf]

#111

Post by shrooms »

rwmj wrote: post #105
DanBC wrote: post #100

Earlier quoted context omitted.

No company is going to resell medical data. We have laws to protect personal information and they are very strict for medical information. http://www.connectingforhealth.nhs.uk/systemsandservices/inf... Have a look at some UK medical information and see if you can de-anonymise it. http://www.ons.gov.uk/ons/rel/subnational-health4/suicides-i... Here's some data for suicide. There are problems with confidentiality in t…

And .. suppose a company does sell it. Or an attacker breaks into their system and steals it. Or someone abroad takes it and is out of the UK's jurisdiction. Medical data can't be got back.

It doesn't even been to be as extreme as that. Idiots put this data onto laptops all the time and they're often stolen from cars and the like.

Re: The NHS is selling your private data – here's the price list [pdf]

#112

Post by blueskin_ »

DanBC wrote: post #107
blueskin_ wrote: post #101

Earlier quoted context omitted.

Postcode, gender and birthdate are enough; not to mention NHS number and full medical history ...

You seem to think that the NHS is releasing all this information. It is not. GPs send this "pseudo-anonymous" information to HSCIC. The HSCIC needs the extra information to create statistically useful cohorts. The HSCIC control access to that data. The HSCIC do some of their own statistics work and they release the results (but not the data sets!) which are often reported in UK news. Researchers, after being assessed…

...and it is now going to be available for sale to anyone who cares.

You're laughably wrong.

http://medconfidential.org/whats-the-story/

http://www.theregister.co.uk/2013/11/21/what_does_nhs_it_wan...

Did you even look at the price list? I guess not.

"Bespoke extract – containing personal confidential data"

Re: The NHS is selling your private data – here's the price list [pdf]

#114

Post by James_Duval »

DanBC wrote: post #107
blueskin_ wrote: post #101

Earlier quoted context omitted.

Postcode, gender and birthdate are enough; not to mention NHS number and full medical history ...

You seem to think that the NHS is releasing all this information. It is not. GPs send this "pseudo-anonymous" information to HSCIC. The HSCIC needs the extra information to create statistically useful cohorts. The HSCIC control access to that data. The HSCIC do some of their own statistics work and they release the results (but not the data sets!) which are often reported in UK news. Researchers, after being assessed…

I thought that your GP did hold your full medical history. I did some work doing data entry for a GP, and most patients had their full medical history on file at the surgery - in both physical and digitised form for the majority.

Re: The NHS is selling your private data – here's the price list [pdf]

#115

Post by louthy »

DanBC wrote: post #107
blueskin_ wrote: post #101

Earlier quoted context omitted.

Postcode, gender and birthdate are enough; not to mention NHS number and full medical history ...

You seem to think that the NHS is releasing all this information. It is not. GPs send this "pseudo-anonymous" information to HSCIC. The HSCIC needs the extra information to create statistically useful cohorts. The HSCIC control access to that data. The HSCIC do some of their own statistics work and they release the results (but not the data sets!) which are often reported in UK news. Researchers, after being assessed…

> Researchers do not get all the information, but get an anonymised version of the pseudo anonymous data.

Where are you getting this information from? Because the price list seems to say that there's identifiable data. Do you have some evidence to the contrary? Just saying "It is not" isn't really enough to go on.

> You also seem to think that your GP holds your full medical history which is laughably wrong.

It isn't laughably wrong at all. They do have your full medical history, either in paper form and/or on a practice management system like Emis. Sometimes you may have moved from one GP to another, and the old GP would print the record to paper and the new one would scan it in, therefore losing the Read clinical-coding (Yeah, for real!). Worst case, you move GPs and your record gets lost. In those cases the next time you go to your GP he/she will ask for your significant medical history, drug history, allergies, family history etc.

So even without storing everything your GP has all the pertinent facts about you. Those facts when in the wrong hands ...

Disclosure: I develop a practice management system used in the NHS and private sector in the UK.

Re: The NHS is selling your private data – here's the price list [pdf]

#116

Post by pbhjpbhj »

nyrina wrote: post #83
pbhjpbhj wrote: post #75

Earlier quoted context omitted.

Well in Cardiff you'll be opted in to organ donation automatically of course.

You say this is a bad thing?

I think government assuming ownership of [parts of] persons is a bad thing, yes.

IMO it makes logical sense to either not assume ownership of anything a person had in life, including their body and allow their family/executors to look after the remains of their person , effects and assets [the status quo]. Or you should say that ownership is void on dying and all assets, including one's body should pass to the state.

It would make far more difference for the state to assume ownership of the things a person had, houses, bank accounts, than it will make to only assume state ownership of a persons body post mortem.

There doesn't appear to be a consistent argument to compel one to take this middle ground.

Re: The NHS is selling your private data – here's the price list [pdf]

#117

Post by anigbrowl »

blueskin_ wrote: post #89
anigbrowl wrote: post #67

Earlier quoted context omitted.

You're assuming that NHS is selling it without the consent of patients. More likely this is for things like patients on drug trials etc. who sign a waiver to allow sharing of their health information. The UK takes confidentiality of public records pretty seriously and has done for years - I seriously doubt you can just just pull any given person's health records without their agreement.

No, it's everyone. http://medconfidential.org/whats-the-story/

Clearly we have differing interpretations of that document. I don't think everyone can get the sec. 251 exemption, just for a start. It is certainly possible to de-anonymize individuals if you know enough details to get a correlation, but how many people do you know sufficiently well to work backwards through that process? If your goal is to sell more shampoo by working out who has dandruff, for example, the marginal cost of de-anonymizing your potential customers is likely to drastically exceed the marginal benefit of each additional sale. Fishing expeditions by Fleet street or private detectives targeted on a particular individual are likely to either raise red flags if too obvious or be wildly expensive if sufficiently stealthy (multiple pull requests followed by client-side correlation) - cheaper to go the traditional route of bribing the nanny or suchlike.

On the other hand, the increased risks of malicious de-anonymization (risk, not certainty) have to be weighed against the obvious benefit of having a portable health record and reducing duplication and administrative overhead if you are taken ill and have to visit a hospital or a doctor who's not your GP.

Re: The NHS is selling your private data – here's the price list [pdf]

#118

Post by ZenoArrow »

cmdkeen wrote: post #110
ZenoArrow wrote: post #98

Earlier quoted context omitted.

"I think that courts, government, the NHS, and UK society at large would come down VERY heavily on any company contravening their contracts." Supposing a leak happened. What makes you think you'll be able to tie it down to a single company? The data could be leaked anonymously, and the risk of such a leak becomes higher the longer this care.data scheme carries on for.

Because the same data set isn't being given to loads of different companies, it is a unique process. The whole concept is you apply for specific data for a reason, get vetted and then receive the data. At the scale we are talking about here the differences between both fields and individual records is going to be so great as to identify almost any leak.

You apply for specific data for a reason, but the whole point of releasing the data in the first place is to do statistical analysis on it, and to do any statistical analysis worth talking about you're going to need large data sets, that are bound to overlap with other data requests.

Let's think of a hypothetical situation. Companies that develop drugs to help people deal with mental illness are likely to want to research what mental illnesses are most prevalent so they know where the greatest ROI for R&D is going to be. To do this they're going to be exploring the data set, pulling patient data for people with mental illnesses of various kinds. However, there isn't just one company developing such drugs, and what seems like a good use of the data to one company is likely to seem like a good idea to another. Now imagine there's a leak of every bipolar person in the UK. Who would have access to such data? There's likely to be multiple interested parties.

Re: The NHS is selling your private data – here's the price list [pdf]

#119

Post by M2Ys4U »

anigbrowl wrote: post #117
blueskin_ wrote: post #89

Earlier quoted context omitted.

No, it's everyone. http://medconfidential.org/whats-the-story/

Clearly we have differing interpretations of that document. I don't think everyone can get the sec. 251 exemption, just for a start. It is certainly possible to de-anonymize individuals if you know enough details to get a correlation, but how many people do you know sufficiently well to work backwards through that process? If your goal is to sell more shampoo by working out who has dandruff, for example, the marginal…

>On the other hand, the increased risks of malicious de-anonymization (risk, not certainty) have to be weighed against the obvious benefit of having a portable health record and reducing duplication and administrative overhead if you are taken ill and have to visit a hospital or a doctor who's not your GP.

That's not the system that's being discussed, though.

Re: The NHS is selling your private data – here's the price list [pdf]

#120

Post by anigbrowl »

M2Ys4U wrote: post #119
anigbrowl wrote: post #117

Earlier quoted context omitted.

Clearly we have differing interpretations of that document. I don't think everyone can get the sec. 251 exemption, just for a start. It is certainly possible to de-anonymize individuals if you know enough details to get a correlation, but how many people do you know sufficiently well to work backwards through that process? If your goal is to sell more shampoo by working out who has dandruff, for example, the marginal…

>On the other hand, the increased risks of malicious de-anonymization (risk, not certainty) have to be weighed against the obvious benefit of having a portable health record and reducing duplication and administrative overhead if you are taken ill and have to visit a hospital or a doctor who's not your GP. That's not the system that's being discussed, though.

All other systems are pendant to that. If this data wasn't available in any way we'd have a story saying 'NHS won't release data, obstructing drug development which could save lives.'
Post reply on HN