{"id":36640,"date":"2016-05-10T11:45:15","date_gmt":"2016-05-10T10:45:15","guid":{"rendered":"https:\/\/blogs.bmj.com\/bmj\/?p=36640"},"modified":"2016-05-10T11:45:15","modified_gmt":"2016-05-10T10:45:15","slug":"ellen-broad-and-tom-sasse-google-deep-in-trust-issues-around-use-of-uk-patient-data","status":"publish","type":"post","link":"https:\/\/blogs.bmj.com\/bmj\/2016\/05\/10\/ellen-broad-and-tom-sasse-google-deep-in-trust-issues-around-use-of-uk-patient-data\/","title":{"rendered":"Ellen Broad and Tom Sasse: Google deep in trust issues around use of UK patient data"},"content":{"rendered":"

We all need different kinds of medical care at different points in our lives. When we interact with our GPs and healthcare providers, we hope that our doctors and nurses know everything they need to know to help us get better. We want to get the best possible care and we want the experience to be as painless (in all senses) as possible. Better data sharing between organisations and people who are providing medical care, and better use of health data\u2014whether in the private or public sector\u2014is going to be a necessary part of making this happen.<\/p>\n

Google\u2019s DeepMind announced the launch of DeepMind Health<\/a> in early 2016<\/a>, aiming to improve direct patient care using data. There\u2019s positives in this: the NHS wants to improve patient care and keep people healthy, and DeepMind are very good at using and understanding the potential of data.\u00a0 But there\u2019s also good reason to be cautious: there\u2019s already suspicion around data projects that involve use of our medical records as a result of other flawed initiatives<\/a>, and lack of trust that what\u2019s being done with our data is secure, ethical, and ultimately for our benefit.<\/p>\n

Over the last week, Google\u2019s collaboration with the Royal Free NHS Trust, which has involved providing DeepMind with access to updating and historical healthcare data on 1.6 million UK patients, has been making headlines<\/a> of the wrong kind<\/a>. Their data sharing agreement with Royal Free as part of DeepMind\u2019s development of its service, Streams, was leaked to the public. While focused on Streams, an app helping staff monitor patients with kidney disease, the data sharing agreement gave DeepMind access to a wider pool of updating and historic hospital data than seemed necessary.<\/p>\n

The potential benefits from this collaboration (improving direct patient care, specifically around Streams) remain persuasive. What has concerned people, and fueled suspicions, is the lack of transparency around how their health data is being shared, with whom, for what purpose, and with what impact. This leads to a breakdown in trust, ultimately stifling of positive uses of our health data that we all want to see.<\/p>\n

Maintaining trust in our healthcare providers<\/strong><\/p>\n

For healthcare systems to function, it\u2019s essential that patients trust doctors with their confidential information. Current policy around data spells out some key principles, both on the rights of individuals and the duties of organisations. The NHS Constitution<\/a> outlines the right of patients to privacy, to be informed about how their information is being used and to opt out if they wish. The Caldicott Principles<\/a>, which were commissioned in 1997 due to concern about how information technology was affecting the way patients\u2019 information was used, set out the responsibilities of organisations. They include “justify[ing] the purpose” of transferring data and “us[ing] the minimum necessary patient-identifiable data possible.”<\/p>\n

Critics of the data sharing agreement between DeepMind and Royal Free have argued<\/a> that it fails to meet both of these conditions. Specifically, they say that the purpose of the deal was not clearly defined\u2014which raises concerns about what the data will be used for, not least given that Google has access to other data with which NHS data could be combined\u2014and that patients affected were not sufficiently informed to be able to opt out. DeepMind and Royal Free<\/a> have countered these claims, arguing that the agreement followed NHS information governance processes, connections to the information are encrypted, and patients can contact the Trust to opt out.<\/p>\n

What is clear is that this situation has been arrived at as a result of a lack of transparency<\/a>. Trust is an essential component of better data sharing, and the demand for it in healthcare is acute. As Dame Caldicott said in a King\u2019s Fund interview<\/a> published on Tuesday.<\/p>\n

\u201cIf the public is willing to trust health and care services with its data, there can be huge benefits for everyone\u2026 But there is little public awareness of the way that information is shared, and that trust has not yet been earned.\u201d<\/p>\n

Openness about personal data can create trust<\/strong><\/p>\n

The ODI has been exploring openness and open data as a mechanism for improving trust in how data that is about us is used. Our personal data design principles<\/a> encourage organisations collecting and processing personal data to be open about what they are doing, how data will be kept secure, and how people might opt out of having their personal data used. Transparency around personal data processing and data portability are concepts at the core of the European Union\u2019s General Data Protection Regulation (GDPR), which will be in force within the next two years.<\/p>\n

DeepMind almost certainly have the expertise and tools to store patient data securely, and treat its use with care. They outline some of their data security and privacy intentions on their website<\/a>, to help patients be “certain that their health data is handled with the utmost care and respect at all times.” They have a review board scrutinising their work every quarter.<\/p>\n

The problem is, people don\u2019t like surprises. And right now, people don\u2019t know whether they can trust DeepMind. A key part of building trust is showing people how you are storing, using, and analysing their personal data in practice.<\/p>\n

Open data sharing by design<\/strong><\/p>\n

For DeepMind and Royal Free\u2019s collaboration, being open about the nature of the project including data security and privacy, might have changed the debate we\u2019re now having. Open by design might include proactively publishing information about:<\/p>\n