Win: NHS admits it has to respect patient data rights

After months of legal pressure from Good Law Project, NHS England has finally admitted it can’t just ignore patients who ask that health records are only used for their care – it has to take each request seriously, one by one.

When we’re in the consulting room, we sometimes have to share our most intimate secrets. So data protection law gives us the right to make sure that our personal information is only available to the doctors and nurses giving us the help we need.

But after the NHS signed a deal with the US spy-tech firm Palantir, it told us this legal right didn’t count for anything. And it also confirmed the so-called National Data Opt-Out – which is supposed to let us say no to sharing our data more widely – was never intended to uphold this right.

If we want to build a system for dealing with patient data that’s fit for the 21st century, then we need a system we can all trust. So we teamed up with Just Treatment to demand a system that is fit for purpose.

Now the NHS has rowed back. Each time a patient asks for their health records to be used for their care and nothing more, it will consider this request from scratch, instead of blindly applying a decision from a previous case. And they’ll weigh up the balance between the benefits to the organisation in sharing data and the individual’s right to control their information every time – as the law requires.

According to Good Law Project’s tech and data lead, Duncan McCann, this “clear shift” is a legal win that “strengthens patients’ control over their data”. But it’s only a first step.

“What matters now is how NHS England looks after patient data in practice,” McCann said. “Companies like Palantir are desperate to make money out of the unparalleled trove of data the NHS holds, but we can’t use that data to improve people’s lives without improving systems to look after people’s data. We’ll be making sure the NHS meets that challenge.”

For Diarmaid McDonald at Just Treatment, getting information from NHS England on how patients’ data rights have been respected has been “like pulling teeth”.

“We will only be able to realise the benefits of health data when the government builds public trust and wins patients’ support for these new technologies to be put to use,” McDonald says.

We’ve already teamed up with Just Treatment to ask the NHS for details about the procedures they’ve put in place to deal with any requests. And when they respond we’ll consider whether we need to follow up with further legal action.

We’ve won clarity on paper. Now it’s time to make sure the NHS looks after patient data in reality.