Medicine and healthcare appear to be in the midst of previously unimaginable changes. These changes might result in an improvement in our understanding of the nature of disease and, in time, assist us in predicting how a patient might respond to treatment. However, the fact remains, sweeping changes have been made to the way medical information is shared and accessed, and the cornerstones of medical law are being eroded for a science still in its infancy. The coming together of genomics, genetics and society in entirely novel ways, brings with it risks that are difficult to quantify, and must be the object of open and sustained public discussion. Genetics, genomics and advanced biotechnology are not business as usual. The public must therefore be given a central role in decision making when it comes to big decisions in these areas. A national genetic database and the commercialisation of our genomic data certainly was a big decision; we will soon have a national genetic database that has been a decade in the making. Throughout this period, the public, reassured by promises of anonymity and misled from the beginning, have been excluded from playing any part in what amounts to no less than a cultural shift. Let me explain.
In anticipation of a supposed paradigm shift in healthcare based upon genetics, New Labour, under the direction of the UK pharmaceutical sector, set about implementing a major legislative programme in order to gain a competitive edge in the development of proactive genomics. It began with NHS National IT Programme, which included, ‘Connecting for Health’ – a set of interconnected databases, containing electronic medical records. The Secondary Uses Service soon followed, a mechanism by which personal medical information can be shared and accessed. Shortly after, the piece of legislation that facilitated all of this was introduced: Section 251 of the 2006 NHS Act. Section 251 is granted by the Secretary of State for Health and provides relief to the common law of confidentiality, Article 8 of the Human Rights Act 1998, as well as the Data Protection Act 1998. It permits access to patient-identifiable medical information without the need for consent. The only thing that is missing is a national genomic database; the last piece in this grand design.
Remember, the premise of ‘Connecting for Health’ and Summary Care Records was that they were ‘essential to treating patients in an emergency or out-of-hours with faster access to key clinical information.’ EthicsandGenetics has long argued that ‘Connecting for Health’ was in fact specifically designed so that electronic medical records would ultimately be linked to personal genetic data.
In response to a Freedom of Information request by EthicsandGenetics, Danny Lamond, Ministerial Correspondence and Public Enquiries for the Department of Health confirmed that a ‘central repository for storing genomic and genetic data and relevant phenotypic data from patients’ will be established. Lamond goes on to say that ‘the report [by the Human Genomics Strategy Group] has been welcomed by the Secretary of State for Health and the Minister for Universities and Science, who have asked for the recommendations to be implemented through a shared strategic framework.’
A national genomic database is a major development which that has far-reaching implications for confidentiality and privacy. With regards to this, the report by the Human Genomics Strategy Group recognises that ‘an individual’s genetic information is sensitive personal data, and a whole genome cannot be truly anonymised.’ Furthermore, ‘there is a risk of the information being misused.’
In September, a further and crucially important development took place: The Clinical Practice Research Datalink (CPRD) was launched. It streamlines medical research by connecting patient information from GPs and hospitals to other records, such as the national genomic storage facility; making the data accessible to both the public and private sectors at a cost. Under the new system, anyone who uses the NHS will automatically become a research subject, unless they chose to opt -out. On the CPRD website, it is claimed that ‘researchers never get access to names, addresses, post codes or dates of birth.’ Moreover, Dame Sally Davies, Chief Medical Officer and Chief Scientist at the Department of Health said: ‘protecting the confidentiality of patients remains a priority, so all data is anonymised and people can opt out.’
When these proposals were initially announced, David Cameron claimed that ‘this does not threaten privacy, it doesn’t mean anyone can look at your health records but it does mean using anonymous data to make new medical breakthroughs and that is something that we should want to see happen right here in our country.’ Shortly afterwards Andrew Lansley claimed that ‘it is not about sharing individual records in a way that can identify who those people are.’ Within the context of medical research, anonymised information is not of that much use. I could not help but feel sceptical. A further FoI disclosure to EthicsandGenetics by the Department of Health revealed that ‘information may be made accessible where it has been effectively anonymised or where there is appropriate legal authority to make it accessible. Whilst most researchers will only want access to effectively anonymised data, legal authority to access identifiable information may be provided through the consent of the citizens concerned or through legislation, such as Section 251 of the NHS Act 2006 can be used to authorise access for specific purposes.’ In a further Freedom of Information request by EthicsandGenetics, the Department of Health was asked if patient-identifiable information will be made accessible to private organisations:
“In most cases, the Department would expect consent to be obtained for disclosures of identifiable data. However, projects may apply to the Ethics and Confidentiality Committee for Section 251 approval where consent cannot be obtained. There are circumstances where it is very difficult to contact patients to seek their consent, or where it is vital that the data are identifiable, for example, to link data with a separate data set.”
When we turn to the number of times Section 251 is secured, a separate FoI request by EthicsandGenetics to the Department of Health revealed that Section 251 of the NHS Act 2006 was been granted 42 times in 2008-09, 36 in 2009-10 and 54 times in 2010-11. This is at the rate of once a week and is often for very large studies. Moreover, this is before the launch of the Clinical Practice Research Datalink. The picture that emerges is that that identifiable personal medical information is being made available, through the CRPD, to private organisations without the consent of the individual. This is in complete contradiction to the official line given by the Conservatives as well as what is stated on the CRPD website. After a series of FoI requests by EthicsandGenetics to the Department of Health, the Department confirmed that patient-identifiable data - which will soon be followed by genetic data - is being made available to private organisations without the consent of the indivdual. After a series of exchanges between the Department and the EthicsandGenetics, the ‘for the public’ section on the CRPD website, which covers privacy and confidentiality, was finally brought a little closer to the realities of current practice. When the website was first set-up it stated that all information shared through the CRPD is strictly anonymised and consent is alwayys sought. By the end of September, it was changed to the following:
“CPRD Researchers never* get access to names, addresses, post codes or dates of birth. They also work under strict rules covered by legal agreements about what they can do with the data and what they must never do. CPRD is based around a service that has been operating for many years and we can state we are not aware of any breaches of our security policy.”
“*There are studies undertaken where patients give consent that some forms of identifiers can be accessed.”
While this may be closer to the truth, it is impossible to reconcile it to the FoI disclosure by the Department of Health, which clearly states that identifiable information is made available through the CRPD without individual consent. Surely, given that it is our data, a modicum of transparency would be the least we could expect.
Let us reflect upon these developments. I am enthusiastic about the prospects of personalised medicine and proactive genomics. However, it is truly objectionable that promises of anonymity do not reflect the realities of current practice or the considerable changes that have taken place over the last decade. Whilst these changed have occured incrumentally, they amount to a cultural shift which has redefined the status of personal medical data and the legal framework that governs it. Given the salience of these developments, and our democratic credentials, the public must be afforded a more central role. Many questions remain unanswered. The impending scenario of personal medical information moving between public and private sectors puts the individual at risk of being targeted by aggressive marketing strategies based upon tenuous claims about genetic predisposition to illness. Pharmaceutical companies will create new 'needs' for products, the medical and scientific basis of which may be little more than conjecture. The commercialisation of personal medical data and the relaxation of the medical research framework, opens up the possibility that genomic information could be used for purposes far beyond the public good. Many now believe that the future of marketing lies in genetics; it doesn't take too long to make the right connections and appreciate that it could be imprudent to hand over our genomic information without serious consideration of the consequences.
At EthicsandGenetics, we believe that big decisions about new forms of biotechnology and proactive genomics must be democratised. People should decide for themselves if there is a clear medical advantage, individual benefit or public good, to be found in handing over our entire genome for purposes far beyond our knowledge. In order to do this, more transparency, more public engagement, is vital.
For more information, please refer to the EthicsandGenetics Report, 'Privacy, The CPRD and the Commercialisation of Personal Medical Information,' in the 'research' section of this website. For more background information and commentary, please refer to GeneWatchUK, 'A DNA database in the NHS.