• New rules will try to extract more value for NHS from sharing patient data
  • Regional NHS data hubs for industry research will go to tender in late 2018-19
  • New data regulations and national patient opt-out introduced tomorrow

New “rules of engagement” are needed to ensure the NHS benefits from sharing more patient data with industry, Lord O’Shaughnessy has told HSJ.

The health minister, who is responsible for data and digital technology, said patient data is increasingly available to academia and industry, and this would expand further with the formation of new regional NHS patient data research “hubs”.

lord oshaughnessy

Lord O’Shaughnessy said the NHS has to be ‘completely straight’ about how it uses data

The Department of Health and Social Care is developing new “rules of engagement” to ensure the NHS receives its fair share of the benefits arising from any products or treatments developed using NHS patient data.

Lord O’Shaughnessy said: “It’s about making sure the value that is created through that data is properly reflected in the benefit that flows back into the NHS.

“We are doing some work at the moment looking at making sure that NHS and its patients benefit from the upside of data used in these hubs.”

Lord O’Shaughnessy said the details on what form these benefits would take were still being developed.

His comments come shortly after two Parliamentary committee reports on artificial intelligence criticised the piecemeal approach to sharing valuable NHS patient data with technology companies.

Both reports cited the controversial data sharing arrangement between Google DeepMind and the Royal Free London Foundation Trust, where millions of patient records were shared with the firm’s AI unit without their consent.

One of the reports recommended the government develop a new framework for NHS data sharing by the end of the year.

Lord O’Shaughnessy said bringing in new data usage guidelines was not a response to the DeepMind controversy, but to the broader growth in data sharing arrangements between NHS organisations and technology companies.

“It’s the way this market is developing. We recognise the need to put the rules of engagement in this space,” he said.

Lord O’Shaughnessy also confirmed that by the end of 2018-19, the DHSC will go to tender for the regional data hubs, in line with recommendations in the life sciences industrial strategy.

The “digital innovation” hubs will connect to new regional health and care records, some covering up to 8 million people, and provide industry and academia with anonymous, but sometimes patient identifiable data, for research.

Lord O’Shaughnessy said: “It’s not shifting data out or selling data on, it’s about providing access to use data to look for trends and develop treatments.”

New data sharing needs to be ‘very transparent’

Lord O’Shaughnessy was speaking ahead of EU-wide general data protection regulations coming into effect on Friday.

GDPR places new obligations on all organisations that hold personal information, including NHS organisations, to process the information more transparently and give citizens better access to that information.

To coincide with new regulations, the DHSC will launch the new national patient opt-out, which will give patients the ability to opt out of sharing their identifiable patient data for research or NHS planning.

The opt-out is in response to Dame Fiona Caldicott’s 2016 review of data security, which recommended new standards for NHS trusts and led to the halting of the controversial Care.data project.

The development of the national opt-out has been contentious, with some groups pushing for some patient information, such as disease registries and national survey, to be excluded from the opt-out and others, such as Dame Fiona, warning too many exclusions could undermine public trust.

Lord O’Shaughnessy confirmed that some exclusions would apply to the opt-out, such as for NHS planning and tracking diseases, with further details to be revealed on Friday.

He said: “The most important thing is to be very transparent with the public about what is in and what is not in scope, because if there is any sense from the public that we are not being completely straight with them then that is what undermines the data sharing agenda.”

“The mistake that was made last time was not focusing on that reassurance to patients.”

The opt-out will apply to national IT systems run by NHS Digital, before being rolled out to the rest of the NHS over the next two years.

Despite much of the central GDPR advice for NHS only being published in the last few months, Lord O’Shaughnessy said he was confident the NHS was prepared for the changes.

“Inevitably, it will be a process of evolution from 25 May onwards but I think, on the whole, we are pretty well prepared,” he said.