The blurred line between service improvement and direct care in the NHS

A recent story in the i-don't-care-about-the-facts-as-long-as-the-headline-attracts-attention online version of the Daily Mail claimed the NHS was about to violate patient confidentiality in the name of cost-cutting and rationing.

A flavour of the content:

NHS bosses are to trawl medical records of tens of thousands of patients to find out who is costing them the most money.
They will identify which individuals frequently see their GP, go to A&E or are on lots of prescription drugs with a view to ‘reviewing’ their care, and trimming their budget...

But concerns have been raised that the information will be used to drive down costs by rationing certain treatments or urging GPs not to refer patients to hospital. There are also worries that bosses will urge expensive patients such as the elderly to buy-in extra home-help or even move into a care home.

It has striking similarities to a national data harvesting project which has been put on hold after concerns were raised that sensitive details would fall into the wrong hands.

The NHS’s Care.data scheme was meant to begin last spring with information from millions of patients’ due to be uploaded so it could be analysed by experts to look at trends.

The story originated in the primary care journal Pulse which took a slightly less tabloid tone but argued much the same points.

One thread of comment on the story on twitter ended up in an ill tempered argument with one of the guys from MedConfidential (the antagonists were both a little ranty, to be fair). Here is how it started:

So you've read the Southend proposals in detail, then @sib313? Integrated care is essential; mixing in secondary uses makes it a #caredata

— Phil Booth (@EinsteinsAttic) June 10, 2015

The issue that is worth expanding on at lengths unavailable on Twitter is the issue of what counts as secondary use of data and what counts as data for direct care. The Twitter thread ranged over many issues but care.data came up a lot and the issue of patient consent for secondary uses was a major topic. 

Phil Booth, I think, believes that there is a very clear dividing line between data used for direct care and data used for secondary purposes. I don't, and I think the Southend story is a good illustration of this (though I have only read the newspaper stories so I can't be 100% sure).

Before I get to the meat of the argument, though, I should say that I actually agree with MedConfidential that patient consent is important and the system should not causally ignore patient wishes. I disagree that the risks of sharing to patient confidentiality are high or that the harms that could arise are large, at least when using careful controls over the use of the data. And consent is supposed to be informed which is hard to achieve when so much abject nonsense is talked about the potential risks and harms of systems like care.data. All data sharing involves some tradeoffs of risks versus benefits and the current NHS leadership has done a remarkably bad job of explaining either side of this.

The big problem Phil worries about, I think, is that while patients mostly don't mind the system holding records for the purpose of treating them, they sometimes object to the use of their data for research or commercial purposes. For example, it is possible to use pseudonymised data to test whether overprescribing of anti-ulcer drugs puts more people in hospital from heart attacks (this is a real research story from PLOS 1). This is relatively unobjectionable. Or, commercial firms could use similar datasets to produce more accurate insurance premia based on your postcode. This worries a lot more people. Some patients don't want their data extracted for either of these purposes, perhaps due to the perceived risks to confidentiality. The important point is that both of these uses of data are clearly secondary: the data isn't being used directly for the treatment of an individual patient.

But the Southend case is a lot blurrier. The local CCG wants to identify patients with frequent visits to A&E or large numbers of prescriptions and so on. Phil argues that this is a secondary use of the data and that many patients might object. The tabloid bullshit spin says it is all about rationing and other evil purposes putting it on a par with torturing kittens or something.

But consider this. Many of the frequent fliers (a somewhat derogatory term for patients who turn up a lot) are using NHS services frequently because something has gone wrong with their care. Asthmatics, for example, sometimes end up in A&E because they have acute exacerbations of the disease and can't breathe properly. But the reason is frequently because they are not properly trained to use their medication. Some don't use their inhalers properly and some are just on the wrong mix of drugs. The issue about identifying those people is not so we can ration their care; it is so we can improve their care. If we give them the right care in the first place they won't need to come to A&E so often: they benefit and the NHS benefits.

We can identify these patients by extracting their GP data and joining it up with hospital data. When we know who they are we can do something about it and improve the care they get. The question is: does this count as a use of data for direct care, or is it a secondary use? Phil Booth seems to be worried that the use is secondary and that patients might well object to the data being shared for this purpose. I think that this case shows that there is no clear dividing line between the two. (I hope we would both agree that the joined-up data should be handled very carefully so accidental breaches of confidentiality do not occur).

The use of patterns in data to identify problems with care seems to me to be something few could have an objection to. It clearly benefits individual patients and the care they get despite the grotesque Daily Mail jeremiads. But this use of data site somewhere between a clear use for direct care (your doctor looks at your past prescribing records before issuing a new prescription) and a use for secondary research (we look at millions of records to test for a excess number of heart attacks in people taking an ulcer drug). 

To me (and I'm a data scientist so perhaps I'm biased) the use of data to improve the NHS is important. It might even be the most important way to meet the efficiency targets in the 5-year Forward View. But these benefits form a continuous spectrum from the direct to the secondary and pretending there is a clear dividing line just make achieving the benefits harder. If we explained these benefits more carefully we might be able to have a more sensible conversation about whether patients should consent to their data being shared.

The Southend experiment isn't (I hope) some Orwellian plot to abuse confidential records but a sensible approach to doing a better job of care for the patients who need it most. Besides, despite what Pulse claims, plenty of other health economies are already doing the same thing (as far as I know).

I'm mystified how anyone thinks we can run the NHS effectively at all or keep improving it if we don't use data this way. 

There is no reason to be paranoid about pseudonymised patient data

The pseudo debate about pseudonymised data

Effective medical research and management of the NHS are both at risk because journalists and policymakers can't seem to explain how patient identity is protected when we use their data.

Every time the topic of pseudonymisation appears in print it seems like it is treated as something like a conspiracy to violate patient confidentiality. Those of us who want to use patient-level information to improve the NHS or to do better research are arch villains threatening to make sensitive patient data public.

The Guardian article on the 100,000 genome project does it again.

The piece alleges that the cack-handed way the department of health has explained how the data will be used is part of an unaccountable conspiracy to misuse people’s most sensitive medical data.

But this is nonsense. The root cause of the problem here is a failure of the policy makers and journalists to understand or explain what pseudonymisation is.

And it isn’t that hard. Explaining it is probably easier than spelling it. The claim in the article is that the data associated with the genome project will be pseudonymised and not anonymised, thereby risking disclosure of sensitive personal details. But the thing about pseudo data is that it is the most effective way to make data useful while protecting confidentiality.

The thing about anonymous data is that it is pretty useless. If we have two anonymous datasets, one about what diseases patients suffer from and another about their genetic makeup we can do almost nothing useful with it. We can’t for example, tell that patients with a particular marker in their genes are more likely to get breast cancer because we can’t link the records in one dataset to the matching records in the other dataset. Same thing with NHS activity data: if we can’t join up the records from the NHS datasets that record patient’s interaction with the NHS to the datasets recording whether they die early, we have no way of finding out what NHS activities keep them alive for longer.

The way we can link the datasets to derive useful insights without risking patients’ privacy is pseudonymisation. Researchers and NHS managers don’t need to know the identities of the patients, just whether the records from different datasets are referring to the same patient. This is done by replacing the more identifiable parts of the data (like date of birth and postcode) with long random-looking numbers in a way that guarantees the same number is generated for the same patient in the different databases. This provides strong protection for the identity of the patients without making the data useless when looking for patterns.

For example, if we join up a variety of records about the interactions of patients with the NHS and those subsequently diagnosed with cancer, we can get great insights that lead to improving the way the NHS works and the lives of future patients. See this Macmillan report, for example.

It isn’t perfect. If you already know a lot about a particular individual and are prepared to put a great deal of effort in it is possible to re-identify people. But this is both hard, difficult to do accidentally and illegal. Besides, there are far easier ways to get confidential information about people which already contains their identity. Most breaches of identity and all the harm from such breaches come from the careless way identifiable information is handled (check the conclusion of the Partridge Report or the Nuffield Council on Bioethics report).

So the furore about the use and handling of pseudo data is a complete red herring. The point is to carefully balance protection of identity, the benefits of research and management use of the data. The alternative is either to throw away the possibility of getting any useful insights or to use identifiable data which runs a much larger risk to confidentiality.

The paranoia around the use of pseudo data seems to arise because neither journalists nor policy makers have understood this simple point.

There are only three options to resolve the public concern about confidentiality:

• We can only allow use of anonymous data which will send a strong reassuring message to the public. Unfortunately a false reassurance since confidentiality breaches are unknown in the pseudo data and all happen from identifiable data handled carelessly by hospitals and GPs. We will also guarantee that the data is useless.
• We can use identifiable data for all analysis, research and improvement. This increases the risk of leaks and imposes an enormous burden of protective bureaucracy on analysts and managers who rather spend their time searching for benefits.
• Or we can work with pseudonymised data and achieve big benefits with little risk to confidentiality.

By focussing on and exaggerating the risks of pseudonymisation, the debate obfuscates the key conclusion that, if we want our health data to be useful, pseudonymisation is by far the best option. Even patients will agree if anyone bothers to explain it to them.