The content of this website is intended for healthcare professionals only

EU plans – threat to patient confidentiality

BMA expresses ‘serious concern’ over proposals

Jo Carlowe

Wednesday, 19 September 2012

Doctors leaders have warned MPs that changes to EU data protection rules could compromise patient confidentiality.

European Commission (EU) draft proposals on the processing and free movement of personal information suggest identifiable health data could be used for research without patient consent, warns the British Medical Association.

BMA director of professional activities Vivienne Nathanson’s written evidence to the Commons justice select committee inquiry into the proposals says the association is concerned that the provisions remove current patient confidentiality safeguards.

Dr Nathanson says the draft General Data Protection Regulation appears to allow identifiable health data to be used without consent for historical, statistical or scientific research purposes when anonymised or pseudonymised data cannot be used.

Although the regulation states that data that could reveal identities must be kept separately, the BMA says clarification is needed as to whether this could be on separate databases or if it must be stored outside the organisations that initially held it.

“The BMA has serious concerns that Article 83 appears to permit the processing of health data, in identifiable form, for research purposes without any reference to consent.

“The only safeguards which appear in the clause seem to be that identifiable data must be kept separate, and researchers can use [it] only if research cannot be fulfilled by using non-identifiable data. This seems to be significantly lower than the existing standard for protection of health data,” stated Dr Nathanson.

While the BMA backs moves to update the directive in light of technological advances and changes to consent provision, the Association remains concerned at a proposal to shorten the time data controllers have to respond to subject access requests from 40 days to 30 days.

In addition, it says clarity is needed over whether GP practices and clinical commissioning groups could be fined if records are not provided in a portable electronic format to patients.

The Commons justice select committee has been asked to conduct an inquiry into the proposals by the European Scrutiny Committee.

Registered in England and Wales. Reg No. 2530185. c/o Wilmington plc, 5th Floor, 10 Whitechapel High Street, London E1 8QS. Reg No. 30158470