The content of this website is intended for healthcare professionals only

150,000 patients have GP data shared without consent

Patients had opted out of allowing their data to be used for research and audit purposes

Ingrid Torjesen

Tuesday, 03 July 2018

A coding error in a GP software system has led to 150,000 patients who opted out of allowing data in their GP record to be used for research and audit purposes, and only used for their care, having their data shared for use in this way.

The patients had registered a type two opt-out but the opt-out had not been sent to NHS Digital due to a coding error in the SystmOne software that the practices were using. This means that NHS Digital were unable to honour patients’ objections as they were unaware of them, so the patient’s data was shared.

Patients are affected if they registered a type two opt-out in a GP practice using SystmOne, which is supplied by TPP, after 31 March 2015.

Both NHS Digital and TPP have apologised “unreservedly”.

Nic Fox, director of Primary and Social Care Technology at NHS Digital said: “The TPP coding error meant that we did not receive these preferences and so have not been able to apply them to our data.”

He added: “This issue would not be able to occur using the new National Data Opt-Out, which has been recently introduced and puts the individual in direct control of their data sharing preferences. Data sharing preferences can now be registered via a simple to use website or by phone or paper form, with the information going directly to NHS Digital rather than being recorded by a GP on a third-party system.”

Dr John Parry, clinical director at TPP, said: “TPP and NHS Digital have worked together to resolve this problem swiftly. The privacy of patient data is a key priority for TPP, and we continually make improvements to our system to ensure that patients have optimum control over information.”

NHS Digital is writing to all affected patients and said that their objections are now being honoured.

Registered in England and Wales. Reg No. 2530185. c/o Wilmington plc, 5th Floor, 10 Whitechapel High Street, London E1 8QS. Reg No. 30158470