More than 2,700 releases of non-clinical information about NHS patients were made to law enforcement organisations in the year to March 2014, the Health and Social Care Information Centre has revealed.
The information is in the HSCIC’s latest quarterly register of approved data releases, covering the period from January 2014 to March 2014.
The details about releases to law enforcement over the longer 12-month period were included after privacy campaign group medConfidential drew attention to their absence from the HSCIC’s data audits.
From April 2013 to March 2014, there were 2,758 releases of non-clinical information made from the National Back Office, including 491 to police forces, 321 to the National Crime Agency and 1,944 to the Home Office.
The HSCIC said the NBO will release “strictly circumscribed” non-clinical information about the geographical area where someone is registered with a GP, along with their name and date of birth, “only…when appropriate legal criteria are met”.
Phil Booth, the co-founder of medConfidential, told EHI he welcomes the release of the information, and said it shows the scale of data being shared with law enforcement.
“We knew police were going and asking and getting data from the NHS… but we weren’t aware of the scale of it. It’s quite shocking. You’re talking of thousands of requests a year – it’s routine.”
Booth said he is particularly interested by the “huge spike” in Home Office requests, and would like to see further information about which groups are making the requests.
“It’s interesting, but we’ve only just seen it: we’re puzzling at it a bit, it’s certainly deserving of more questions.”
He said the HSCIC needs to be transparent about how it releases information for law enforcement so the public knows it is being handled appropriately.
“Our concern is not so much that it shouldn’t happen at all, because there are cases with criminals where it’s absolutely appropriate. But it should be done through proper procedure – it shouldn’t be done behind closed doors.”
Booth said there are also public health implications related to the release of data, as illegal immigrants could potentially avoid treatment if they fear being traced through the NHS.
The HSCIC says it will release non-clinical information to assist law enforcement with tracing individuals when compelled to do so by a court order or under section 29 of the Data Protection Act.
The requesting organisation will generally only receive the name and date of birth under which the individual is currently, or has previously been, registered with a GP and the area in which the GP is located – but not the details of the individual GP surgery.
It says there are “rare cases” when demographic details may be given, such as when an individual has died, but not clinical information.
The register also outlines 17 releases of pseudonymised data, 15 releases of identifiable data and 16 releases of anonymised data to health and social care organisations and the private sector between January 1 and March 31 2014, under HSCIC data sharing agreements.
Another 24 releases of pseudonymised data and 308 releases of identifiable data were made during the same period after they were earlier approved by the NHS Information Centre, which was replaced by the HSCIC on April 1 2013.