Feeds

NHS patient privacy? What patient privacy!

Trust me, I'm a Doctor

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

Up to 200,000 requests are made under by investigators under false pretences to obtain health information on British patients each year. And most attempts succeed, according to the Foundation for Information Policy Research (FIPR).

This calculation is based upon an old pilot study in one health authority exposed 30 phone calls per week made under false pretences, with investigators pretending to be doctors or health administrators. The pilot was inspired by a BMA recommendation in 1996 that telephone requests to a health authority or provider for patient information should be logged, approved by a clinician and then authenticated by calling back to a telephone number in the NHS directory.

So did the NHS embrace and extend this scheme? Of course not, the whole idea was shelved.

The FIPR wants to see telephone request auditing reintroduced. The vast majority of bogus enquiries could be stopped with the basic telephone discipline tested in the pilot scheme, it says.

The willingness of UK health professionals to hand over confidential information to every Tom, Private Dick and Harry, should set alarm bells ringing, with the massive centralisation of NHS patient information in place.

According to the FIPR, NHS Systems fail to protect patient confidentiality. The influential think-tank is urging the Government to improve privacy protection of patients' medical information. The call to action comes in response to a National Health Service (NHS) consultation.

Current NHS strategy is focused on creating a central electronic patient record database. We already have a "clearing" database which records payments made for all hospital treatment, along with the names and addresses of patients.

And other medical databases available to ministers and civil servants contain enough information to identify the vast majority of the patients.

Making this information available to so many NHS administrators and civil servants is unethical and will lead to growing abuse, the FIPR argues.

Instead of creating a central patient records database, the NHS would do better concentrating on preventing existing abuse, the FIPR says.

It also recommends that patients must unambiguously consent before their medical records are shared with anyone but the clinical staff actually providing treatment. Breaches of confidentiality should automatically be notified to patients and invoices should not carry a patient's name, but simply an order number.

FIPR chairman Ross Anderson said: "Patients entrust some of their most sensitive personal information to their doctors. NHS managers should not be trying to undermine that trust by spreading identifiable patient data around the health service bureaucracy and the civil service."

He continued: "The NHS must modernise their systems to protect rather than undermine patients' privacy. Otherwise they risk the trust between patient and doctor that is vital for effective healthcare." ®

External Links

Details of the NHS consultation
... and FIPR's response

Related Stories

Key NHS project in sick bay
NHS PKI project in sick bay
Health industry warns of 'sinister' govt legislation

Security for virtualized datacentres

More from The Register

next story
It's Big, it's Blue... it's simply FABLESS! IBM's chip-free future
Or why the reversal of globalisation ain't gonna 'appen
'Hmm, why CAN'T I run a water pipe through that rack of media servers?'
Leaving Las Vegas for Armenia kludging and Dubai dune bashing
Microsoft and Dell’s cloud in a box: Instant Azure for the data centre
A less painful way to run Microsoft’s private cloud
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
CAGE MATCH: Microsoft, Dell open co-located bit barns in Oz
Whole new species of XaaS spawning in the antipodes
AWS pulls desktop-as-a-service from the PC
Support for PCoIP protocol means zero clients can run cloudy desktops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.