Fears of patient information leak prompt inquiry into mapping internet site

A screengrab taken on Monday from the homepage of on the web mapping firm Earthware. Health authorities have launched an investigation into the site

A support offered by a data mapping site was closed down on Monday, as wellness authorities launched an investigation into the website amid concerns it had apparently acquired millions of identifiable patient records with out regulatory scrutiny.

A Hertfordshire-primarily based on-line mapping organization, Earthware, which gives providers which includes home data, claimed to enable consumers to locate areas in England exactly where a single person had gone for specialised therapy.

Though this would not always pinpoint the patient concerned, the risk of identification is regarded as so high that information protection rules prohibit the release of info when fewer than 5 individuals are involved. The internet site charged customers for each search, but did provide a totally free support to sample the tool’s usefulness, which allowed the public to search for heart and respiratory circumstances.

In a statement, the company insisted the map contained “mock information”.

On Monday night the Health and Social Care Information Centre (HSCIC) mentioned the website tool had been shut down and an investigation launched into how the information had been obtained, as it had not been cleared by its regulatory method.

A spokesman for the information centre said: “The link to this tool has been taken down following a request by the HSCIC. We are investigating urgently the supply of the data employed and whether controls demanded of any organisation using data have been maintained. Soon after this investigation we will get any necessary action.”

In a statement issued on its site, Earthware explained it was “confident that we have not breached any legal or regulatory guidelines relating to the licensing or publication of [Hospital Episode Statistics] information”.

It stated that the map displayed mock information held by a third party that the business had in no way held HES information on its servers and that no patient-identifiable information was ever displayed on the map. “We will carry on to co-operate totally with the HSCIC if essential,” it concluded.

The investigation comes amid issues that there are probably businesses in the Uk able to generate information dossiers on sufferers by tapping new technologies to unearth ever far more intimate information about the public. The dataset apparently came from hospital episode statistics, which hitherto had been regarded as a fairly “protected” repository of delicate information.

NHS England has previously defended its flagship care.data scheme – which proposes to extract data from GP surgeries – by pointing out that for 25 years hospital statistics had not suffered a major breach of privacy. Roll-out of the scheme was put on hold in February for 6 months.

Phil Booth of medConfidential, which campaigns on healthcare privacy, told the Guardian that “NHS England officials have claimed once again and once again that there has been no misuse of hospital episode statistics. Now a commercial real estate web mapping firm appears to be acquiring entry to hospital patient-level data.”

Booth known as for a “total transparent” disclosure of all the hospital information so far launched and called for the care.information scheme to be “halted”. “Until there has been a complete transparent audit of every single release of patient information the whole program that they propose must be halted.”

Underneath care.information, unless of course individuals opt out, the HSCIC will extract a person’s NHS quantity, date of birth, postcode, ethnicity and gender. After the method is reside, organisations this kind of as university study departments – but also insurers and drug companies – will be capable to apply to the HSCIC to gain accessibility to the database. If an application is approved then firms will have to pay out to extract this information, which will be scrubbed of some personalized identifiers but not enough to make the info completely anonymous – a approach identified as “pseudonymisation”.

This week Jeremy Hunt will push through a number of amendments to the Care bill connected to protecting privacy.

The coalition will produce a new law that would bar any organization that obtains patient data beneath the care.data programme and employs it in a malicious way from ever bidding to use health-related information yet again. Hunt also proposes that the NHS’s confidentiality advisory group, which advises the overall health secretary on accessing confidential patient information without consent – be produced a statutory entire body.

Earlier on Monday, Sarah Wollaston, who practised as a family medical doctor and is now a Tory MP on the well being pick committee, questioned how the NHS hospital patient database for England was handed to management consultants who uploaded it to Google servers based outside the Uk.

Wollaston tweeted: “So HES [hospital episode statistics] information uploaded to ‘google’s immense army of servers’, who consented to that?”

The patient data had been obtained by PA Consulting, which claimed to have secured the “complete begin-to-finish HES dataset across all 3 locations of collection – inpatient, outpatient and A&ampE”.

The data set was so large it took up 27 DVDs and took a couple of weeks to upload. The management consultants said: “Inside of two weeks of starting to use the Google tools we had been ready to generate interactive maps directly from HES queries in seconds.”

Specialists said there had been considerations over the reality that data can effortlessly be shared in the Google technique – and that the danger of an accidental information leak would have catastrophic consequences for trust.

In a statement PA Consulting Group said it had obtained the information from the predecessor of the HSCIC. “The data set does not have info linked to certain individuals. The information is held securely in the cloud in accordance with situations specified and accepted by HSCIC.”

The HSCIC mentioned: “PA Consulting utilized a merchandise known as Google BigQuery to manipulate the datasets offered and the NHS IC was conscious of this. The NHS IC had written confirmation from PA Consulting prior to the agreement becoming signed that no Google staff would be ready to entry the data entry continued to be restricted to the people named in the data sharing agreement.”

Fears of patient information leak prompt inquiry into mapping internet site