Data confidentiality - more lies

It really does not matter anymore if civil servants leave confidential database records in coffee shops. Despite numerous promises to the contrary, Computer Weekly reveals:

A new national database of confidential patient records is being opened to access by NHS staff who need no professional qualifications - despite official assurances that records will only be accessed by specialists who are providing care or treatment. A document obtained by Computer Weekly under the Freedom of Information Act also provides evidence that NHS Connecting for Health - which runs part of the £12.4bn National Programme for IT [NPfIT] - has quietly decided to weaken assurances given to patients about the confidentiality of records. Doctors are angry because they say that patients were given an assurance that non-clinical staff would be unable to access the national summary care record database which is being trialled at NHS trusts in various parts of England. (Computer Weekly)

We had evidence last year, again from Computer Weekly, of the ease with which any hospital employee can access private patient data. A well known celebrity checked into North Tees Hospital

An NHS primary care trust has warned of a new risk to the confidentiality of medical records under the National Programme for IT (NPfIT), after more than 50 staff viewed the electronic records of a celebrity admitted into hospital. (full story here)

It is not just doctors who can access confidential records. Or nurses. It is anyone.

Bolton Primary Care Trust has decided to change the procedure at hospitals to allow healthcare assistants - sometimes called nursing auxiliaries - to view the care records database instead of receptionists. But GPs say healthcare assistants usually have no professional qualifications and are not clinical staff treating patients. Paul Cundy, spokesman for the British Medical Association's GP IT committee said the papers obtained by Computer Weekly showed there has been an "erosion of the confidentiality of patient records that we feared would happen". He said that healthcare assistants were in essence "trained receptionists". (Computer Weekly)

And it is just as bad, or worse, in the USA

In March 2002, the Bush administration amended the medical privacy rule so that doctors and hospitals do not have to obtain written consent from patients before using or disclosing medical information for treatment, the payment of claims or any of a long list of health care operations such as setting insurance premiums and measuring physician competence. (Consumer Action)

Many people seem relaxed about the security. “I don’t mind at all if someone knows I had a broken leg a few years ago” But supposing, twenty years ago, you caught a gonococcal infection. Do you want that to be publicised? It happens.

Here are just a few examples from America of what can go wrong:

• In 1998 an Atlanta truck driver lost his job after his insurance company told his employer that he had sought treatment for alcoholism.
  
  
• In 1998 a Longs Drugs pharmacist disclosed to a California woman that her ex-spouse was HIV positive, information she later used against him in a custody battle.
  
  
• In October and November 2001 the complete psychological records of 62 children and teens were posted on the University of Montana’s public web site for eight days before the error was caught. (Consumer Action)

The British government promised that there would be strict confidentiality of all private medical records uploaded to the NHS Spine. The government lied.