News Article

URGENT: Contact your GP to safeguard your medical data

Patient data stored in GP surgeries is to be extracted and placed in a central database. We are strongly advising students to act now and OPT OUT.

No ratings yet. Log in to rate.


19th February 2014 update:

NHS England has acknowledged that they need to do more to inform the public properly about the scheme and decided to POSTPONE the harvesting of patients data for 6 months, i.e. until Autumn.

Nevertheless, our advice remains: read about the scheme & make informed decision to protect your confidential information.


15th February 2014



From March, NHS England will upload medical records regularly from GP surgeries in identifiable form to a central system administered by the Health and Social Care Information Centre (HSCIC). GPs have no choice but to supply the data and if patients don’t want it to happen, the onus is on them to opt out.


In addition to diagnoses and treatments – including mental health diagnoses – the first dataset includes date of birth, postcode, ethnicity and gender together with ‘lifestyle’ details such as smoking habits, obesity and alcohol use.


The data will be held on HSCIC systems with personal identifiers still attached and made available in various forms to researchers, local commissioning bodies and to private companies that are approved as HSCIC ‘customers’. Several such companies have already received approval.

There are a number of key concerns:

  1. The lack of informed consent or control over what happens to medical data. It feels like this is being foisted upon patients.
  2. The fear that their data will be re-identified and used against them. This is exacerbated by the lack of certainty about where people's data will be used. Many people are OK with their data being used to improve NHS services, but feel uncomfortable with their data being sold on to third parties such as pharmaceutical companies, with a particular concern about insurance companies getting hold of the data and potentially re-identifying it and using it to influence insurance premiums.
  3. That storing the data centrally leaves it vulnerable to being hacked or there being some other kind of data breach (the old laptop-left-on-train classic).
  4. That it's been communicated so badly that people don't know what is happening with their data.

These concerns are compounded by a lack of trust in the government (particularly in the wake of Edward Snowden's revelations) and the NHS's ability to manage large-scale IT projects. (Wired)


NHS England agreed to carry out a mail drop to every household in England. Unfortunately this is being done in the form of a leaflet to households rather than a personal letter. Because the publicity is being carried out in such a minimal way, we are concerned that students may not see this leaflet at all. They are in a particularly vulnerable group as they are away from home and highly likely to be in shared accommodation.


If students do not wish to have their confidential medical data uploaded from their GP surgery to HSCIC, it is vital that they opt out as soon as possible and preferably before the uploads begin. Once uploaded the data will never be deleted, even if a patient later opts out.

Action: contact your GP surgery and notify them that you wish to opt out. You can use the template letter below:


Dear Doctor,


I am writing to give notice that I refuse consent for my identifiable information  to be transferred from your practice systems for any purpose other than mymedical care.

Please take whatever steps necessary to ensure my confidential personal information is not uploaded and record my dissent by whatever means possible. This includes adding the ‘Dissent from secondary use of GP patient identifiable data’ code (Read v2: 9Nu0 or CVT3: XaZ89) to my record as well as the ‘Dissent from disclosure of personal confidential data by Health and Social Care Information Centre’ code (Read v2: 9Nu4 or CTV3: XaaVL).

I am aware of the implications of this request, understand that it will not affect the care we receive and will notify you should I change my mind.




Full name:






Date of birth:


NHS number (if known):